Thank you for the info, pmterp.
I think I figured it out...will know for sure tomorrow. There were some firewall NAT policies forwarding port 5001 to the client's old phone system (configured long before I started doing this client's IT). This was probably preventing the phones at the remote site from connecting properly via port 5001 to get the provisioning file, but 3CX could see them via the SBC. Hadn't really tried connecting to the system via https from offsite, so didn't realize this was an issue...