why is ssh using cached dns record when dig reports updated version of cname record?
dig performs an actual DNS query, while ssh will simply ask your system (most likely through gethostbyname) to resolve a name.
dig will ask an actual DNS server while ssh will ask the local service in charge of DNS (nowadays, most likely systemd-resolve) which will cache results.
If using systemd, you can clear the cash using systemd-resolve flush-caches.