Seems that initial reject was triggered by a password change. Fortunately this worked apart from the reject.
I guess there is a bug in the recycle bin feature introduced with the errata update 365:
https://errata.software-univention.de/#/?erratum=5.2x365
The account of the DC was vanished of the AD in the past. In the end it was rejoined and the object recreated. Here is the background (german):
Seems that the updated connector tries to restore the old account although there is a new one since years.
Can please someone of Univention comment how I should proceed? Should I create a bug report?