Wildcards are easier because it's less work for you. But it's also less secure because there is only one private key for all the nodes using that cert - compromise the private key, compromises all the nodes. Apart from the scare tactics, it's better IMHO to issue each node with its own cert. Since you're signing them with your internal PKI there is no $$ cost involved.
Replacing each ISE node's Admin cert causes that node to restart its application services - bear that in mind - depending on whether your NAD's are configured for primary and secondary services, you could do this in business hours.
Wildcard certs from public CAs (apart from let's encrypt) cost more than non-wildcard certs.
