OK, I fixed my SSSD issue. It turns out that DNSSEC needed to be turned off. We are not
using that in our environment. Once I did that everything was good.
I also ran the ipa-healthcheck again and everything is good there too!
So, both problems were related, just not in the way I thought originally.