I see the SSL certificate provisioned at about 11:40 AM PST. My best guess as to root cause of the delay is the time to live (TTL) values in the previous DNS records.
Edit: Your current external DNS configuration is perfect, by the way. Especially using the www subdomain as the primary custom domain because an A record is used for the apex domain.
In other words, you should never make the apex domain the primary custom domain if the apex is the A record to 104.198.14.52.
You can make the apex primary but unless an ALIAS type DNS record (a non-official record type) is used for the apex we don’t recommend making the apex primary. You made www primary and this is what we recommend for an A record on the apex.