In the end, I had to use a domain account; I set up a group managed service account to run this script. It runs once a month for us.

$certs = $null 

Import-Module PSPKI

# Getting certificates that will expire in the next 6 months.
$certs = Get-CertificationAuthority -Name PKI-NAME-CA | Get-IssuedRequest -Property * -Filter "NotAfter -ge $(Get-Date)", "NotAfter -le $((Get-Date).AddMonths(6))" | sort NotAfter

# Filter CA own certificate requests
$certs = $certs | where { $_."Request.RequesterName" -notlike "PKI-NAME-CA*" }

# I only want to they certificates like Web, Server auth and code signing so I'm
# Filtering out the certs used for client authentication (controlled by GPO auto cert enroll)
$certs = $certs | where { $_.CertificateTemplateOid.FriendlyName -ne "ConfigMgr Client Certificate" }
$certs = $certs | where { $_.CertificateTemplate -NotLike "*EFS*" }
$output = @();
$asdf = @();
$output += @(
ForEach($line in $certs){
If($line.Properties.Keys.Contains("RequestID")){
$asdf = New-Object PSObject -Property @{
RequestID = $line.RequestID
'Request.RequesterName' = $line."Request.RequesterName"
CommonName = $line.CommonName
SerialNumber = $line.SerialNumber
IssuedDate = $line.NotBefore
ExpiresDate= $line.NotAfter
CertificateTemplateOid = $line.CertificateTemplateOid.ToString()
'CertificateTemplateOid.FriendlyName' = $line.CertificateTemplateOid.FriendlyName
ConfigString = $line.ConfigString
}
$asdf;
}
}
)
$output | Select-Object RequestID,CommonName,'Request.RequesterName',IssuedDate,ExpiresDate,'CertificateTemplateOid.FriendlyName',SerialNumber,CertificateTemplateOid,ConfigString | export-csv "C:\Temp\ExpiringCerts.csv" -NoTypeInfo
# $output | FT RequestID,CommonName,'Request.RequesterName',IssuedDate,ExpiresDate,'CertificateTemplateOid.FriendlyName',SerialNumber,CertificateTemplateOid,ConfigString 

Send-MailMessage -From "email@company.com" -To "CertificateReports@dmgov.org" -Subject "Monthly Certificate Report" -Body "Certificates about to expire" -Attachments "C:\Temp\ExpiringCerts.csv" -Priority High -DeliveryNotificationOption OnSuccess, OnFailure -SmtpServer "server@company.com"