DNS server issue and/or DNS rebinding protection.
By signing in your server you’ll get automatically a FQDN on the plex.direct domain and a fitting TLS certificate for your server. Which then enables the server to use encryption. But the certificate is ‘pinned’ to the FQDN of your server - it is not valid for the plain local IP address of the server (nor any local hostname you may be using in your local network).
And if your ISP’s DNS server is poor or your router has an active DNS rebinding protection (which is misfiring on plex’s use of the DNS system) then the traffic may go over the WAN address.
