I have a few Traefik instances that request wildcards independently of each other. Each with the same config, per server.

Leaking is an issue but we're talking about internal services too.

well, I configure my services te request their own wildcard certs from a caching proxy acme to letsencrypt. Easy peasy.