You can't renew "some of" a certificate — etesync.lemnoslife.com is one of the SANs in the gitea.lemnoslife.com-0001 certificate, so Certbot must validate it every time. To get rid of it you have to reissue the certificate without that domain:

1. See which domains are in the cert

certbot certificates
# or
grep 'Domains' /etc/letsencrypt/renewal/gitea.lemnoslife.com-0001.conf

2. Reissue with the same cert-name, minus etesync

List every domain except etesync.lemnoslife.com — passing -d with an existing --cert-name replaces the domain set:

certbot --nginx-ctl /usr/sbin/nginx \
  --cert-name gitea.lemnoslife.com-0001 \
  -d v.lemnoslife.com -d gitea.lemnoslife.com -d <...other domains...> \
  --force-renewal

Afterwards, plain certbot renew will no longer touch etesync.

Alternative: keep the domain, fix the 404

The error shows the challenge is being redirected to HTTPS and then 404s — typically because the etesync vhost proxies everything to the etesync backend. Adding an ACME location block before the proxy in that server block fixes it without removing the domain:

location ^~ /.well-known/acme-challenge/ {
    root /var/www/certbot;   # or /var/www/html
    default_type "text/plain";
}

If you just want to skip that certificate entirely

certbot renew --cert-name <some-other-cert>    # renew only that one
# or disable it permanently:
certbot disable --cert-name gitea.lemnoslife.com-0001   # Certbot ≥ 2.0

Note the disable command skips the whole certificate (all 7 domains), not just etesync — so option 2 is the right one if you only want etesync gone.