It is very much possible that your ISP could be messing with your DNS request.
Regular old DNS defaults to being UDP based, unencrypted and unauthenticated (yes, it can be TCP based and can be authenticated using DNSSEC, but the vast majority of DNS request in the wild will be UDP based and not using DNSSEC) - meaning it is trivial for your ISP to intercept it, read it, and send a reply pretending to be Googles DNS resolvers (184.108.40.206 and 220.127.116.11).
You’d be sent to a website that potentially would act as a proxy between you and your target destination. From there they’d be able to inject adverts that they’d collect money on, or more nefariously, they’d be able to sniff any data you send to the site, such as login credentials.
The reason it fails is, as you mentioned, that it fails to present the right certificate.
I would not say you are being unreasonably paranoid, given that this used to be “standard practice” for US based ISP’s some 10-15 years ago, and might very well still be today.
Edit: an alternative reason for the certificate error is that the site operators have misconfigured the webserver to present the wrong certificate.
You mention that you use Firefox. Firefox does use DNS-over-HTTPS for some locales/regions and you might be lucky that it’s enabled for you. If it is, your ISP cannot easily/trivially interfere with the DNS lookups made by Firefox. You can read more about it here: https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs