Honestly I stopped trusting lastmod ages ago, half the CMS setups out there bump it every time someone touches a template or updates a plugin. What actually worked for us was diffing the sitemap itself, watching which URLs show up and which quietly disappear, that gave way cleaner signal than any date field. Also worth saying, crt.sh will let you down if you are polling more than a handful of domains, there is no uptime guarantee and nobody knows what the actual rate limit is. Keep censys or a direct CT log query in the loop as a backup so one dead endpoint does not kill your whole pipeline. And that SAN count filter for cutting shared hosting noise, it works until someone moves their subdomains to vercel or cloudflare and then it just silently eats real hits without telling you