I think it's related to security, because that's the only step remaining. Gcms notes show that CBSA are waiting for something from their external security partners but doesn't specify what exactly.
CSQs were obtained in 2022 and all other steps (eligibility, criminality, medical) have passed.