And finally found the last one, it was the "File and Printer Sharing (SMB-In)" rule. Once I changed the scope of the IP range from local subnet to extend the range slightly, that fixed it. Guess Windows 2012, 2012R2, even Windows 2016 server didn't have this rigid of a firewall rule set...