duckdns validation has one big limitation. Duckdns service only lets you set one dns txt record for the account. Therefore, you can only validate one address with letsencrypt. When you set subdomains to wildcard, that address is *.customsubdomain.duckdns.org. Everything else in extra domains is ignored.
If you want multiple addresses covered with duckdns, you’ll have to use http validation, which allows multiple addresses, but no wildcard.