These sound like common blacklist-style defenses. As examples, mail services use RBLs to prevent spam, Cloudflare services often require captchas from Tor exit node IP addresses, many websites decline signups from throwaway email addresses like Mailinator. Credit card companies use various indicators to prevent fraud.
I'm not saying these measures are perfect or fair, but they are not related to government (though government may also use them); they are just obvious ways to prevent unwanted activity such as spam, fraud, hacking attacks, etc.
> Their AI determined that people using particular email providers need to be watched
How do you know that government has concluded 'particular providers need to be watched', and that the decision was performed by an AI?
> for using a privacy focused email address when signing up for services operated by a government entity
How do you know the cause?
The type of monitoring used was disclosed as was the "likely cause" of me being flagged. This wasn't a secretive kind of thing. Of course one can't "know" anything as it's a black-box. But it's not a stretch to see how such systems may conclude, from automated profiling, that users of privacy-centric services are more likely to be associated with fraud and hence flagged. This also represents a more general issue with the application of machine learning.
When your payment was declined, the company 1) had access to this watch list that you're on, 2) was able to share with you that you were on a watch list, and 3) you were able to figure out why this is. This sounds very unbelievable to me. The data that comes from programs like this isn't generally being passed around to businesses, and if it is, the support folks are not going to be in the know.
It still sounds more like you're being hit by algorithmic blacklisting than that you're on some secret not-secret blacklist. That, or you got added to a public sector blacklist, by some security company because you use ProtonMail which has issues with abuse by fraudsters.