I tried looking for more information, but all I can see without logging in is the basics put up on the front page. So, I'll ask my questions here.

Is expiration monitoring done solely through certificate transparency logs or also by connecting to the host? I assume both, but I couldn't find a confirmation of this.

Can the service monitor hosts that aren't accessible publicly? For example, using an agent running inside a company's internal network.

If the answer above is "Yes" then a follow up question is: Does this service support certificate checking for certificates that aren't on certificate transparency logs? That is, certificates generated from a company's internal certificate authority.