Hi, CTS and Certified PlayStore can be reached by using the xiaomi.eu ROM without Magisk.
I have always passed the SafetyNet status on every beta or stable and kept Widevine L1. I never use Magisk.
Try it without, best is to delete Magisk and then clear the cache, or flash the ROM completely...