I’ve seen this many times, and when the in-portal upgrade fails on multiple ASR-protected VMs, it almost always means the Mobility Agent can’t update itself and needs a manual reinstall.
You can download the Mobility Agent directly from the ASR vault:
Azure Portal → Recovery Services Vault → Site Recovery Infrastructure → Configuration Servers (or Process Server if you use one) → Download Mobility Service.
This gives you the exact installer for your setup.
Once downloaded, run the installer manually on the VM. It will upgrade in place without breaking protection.