Can I use a wildcard ssl cert for subdomains, with let's encrypt for bare & www?
The Short answer is: Yes you can.
I use this solution, even I own a LE wildcard certificate.
On some other specific domains, a standard certificate
A long answer is not needed IMHO