How are you following this in practice, especially if every service has its own certificate that it rotates every two months via letsencrypt or similar?

It's not clear to me how you know who asked for the certificate in the log. Do you somehow compile the private keys of all entities that are allowed to request certificates and compare that to the CTL?