CSRF exploits one browser behavior: cookies are attached automatically, no matter who initiated the request. Tokens work because an attacker can make your browser send a request but cannot read your page to find the token. Here is the whole mechanism, with working PHP.
Certificates are free and automated, which is why the remaining failures are so consistent: a missing intermediate that only breaks on some clients, and a renewal cron that fetches a new certificate the server never loads. Here is how to verify both from the command line.