Hi Chris,
Careful there, while there are some Java processes intervening in the SonarQube VSTS tasks (mostly in ‘Run Code Analysis’), keep in mind that the task themselves are .Net components, and have some .Net logic in them. All that to say that updating Java trusted certificates is likely to not be sufficient, you should also make sure that custom certificates are trusted by Windows itself on the agent. (and one approach to troubleshoot could therefore be for you to login directly in that agent and see if you can successfully connect to SonarQube via proxy, independently of any Java process consideration).
EDIT: see reply below for Node.js aspects too