A 10% rejected share rate is definitely a concern. Since the miner operates fine on other pools and other miners (like the S19) perform well on CK Pool, this likely points to a compatibility issue between the S21+ and CK Pool. Of course, this assumes that both miners are on the same network and have similar latency to the pool.

To investigate further, you could try running ckproxy in a Docker container on Windows. Point the S21+ to the proxy, and then have the proxy forward traffic to CK Pool and possibly to another pool as a comparison. This setup could help reveal where the issue lies—whether it's with the miner's communication, the pool's protocol handling, or something else.