See:
https://www.reddit.com/r/exchangeserver/comments/oi6f04/cant_install_exchange_server_2016_cu21/
You cant have RODCs in sub OUs under Domain Controllers OU. I can confirm, I moved my RODCs to the root DC OU, and /preparead ran fine.
I then moved them back to the sub-OUs and the upgrade is running fine so far. I'll update when it finishes..