Windows was logging Schannel fatal alert 40 and fatal alert 70 errors. This turned out to be related to the System cryptography: Use FIPS compliant algorithms Group Policy setting, even though that policy was disabled.
The Cause
Microsoft’s documentation says this GPO controls the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicyOn the affected machine, that value was still set to 1 (FIPS mode on), despite the policy being disabled.
The Fix
I created a GPO at the workstation level with a registry preference (action: Update/Replace) on HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa that sets FipsAlgorithmPolicy to 0. After the next reboot, the machine stopped generating the Schannel errors.
Related: disabling SSL 3.0 in the SCHANNEL registry settings on IIS.