The main difference was that the failing one was a named instance (hostname\instancename) instead of just hostname. After trying different connection string variations and confirming traffic hit the server through the firewall, we found the root caus...
