Can connect to the .onion address over LAN, but not over internet (NordVPN)

This is completely unrelated to the OP’s two year old question, and detailed in the docs, which sections on how to Windows install Bonjour on specifically.

For Linux:

For Tor Browser, you’re using it correctly, Tor Browser does not read your installed Root CA.