We have the exact same issue. We’re headless, with Shopify store on custom domain and password protected.
For logged in users we use Multipass and with it the checkout works correctly:
[Redirects]
However, when we don’t use Multipass, for anonymous shoppers (I disabled custom domain to have less redirects to report below):
[Redirects]