More tests show that it is not network-related (and the test with the RIPE Atlas probes is misleading) since a client machine on the same network has no problem. So, there is only one client with the (still mysterious) problem.
The machine with the problem was able to talk with other IPv6 DoT resolvers such as
Restarting the DoT server (a dnsdist) solved the problem. Now, everyone is happy. Since dnsdist had more than two months uptime, I assume there was something wrong in it.