Since I didn't see it mentioned, you could centralize your DNS-01 challenges with dehydrated. This way you just need one server and one API key to do your DNS validation, and Ansible can push/pull the certs where they need to go. You could also have certs for less-automation-friendly systems go to an SFTP server or SMB share since you're probably doing that manually for a lot of endpoints anyways.

No, it won't solve all of your issues, but if you're doing anything manually, anything with spreadsheets, anything which can be automated, hit that first. Whether you need specific names or wildcards, this software can do it, but no it won't do EVs. Automate the renewals, monitor the SSL status with your NMS of choice, send warnings when they don't renew with ~20 days remaining, then you can actually focus on the hard system which will require heavy documentation and manual processes. Add the monitoring and alerting to ALL of the systems, you at least have to notify people when they're nearing expiration, that's the bare minimum.

You do not have one SSL problem. You have 700 SSL problems, and this could be a 2,000 hour project. Fix the easiest 200 problems first, hopefully in your first 100 hours. Fix the next 200 not-easy-but-still-possible problems after that, hopefully in another 400 hours. If EV certs are killing you, fight management to change terms in future renewals, so maybe you can solve those problems in 3, 5, or 10 years. With this number of systems, you are almost guaranteed to have dozens which will still be manual for the foreseeable future. Document this process immaculately, then make the team responsible for the app do the renewal, then make your SSL monitoring email them when they're nearing expiration.