Looking at your /ip ipsec peer print, I can see hash-algorithm=sha512 enc-algorithm=aes-256,3des dh-group=modp1024 and I wonder how it could ever work with the older versions of Windows clients as these older versions definitely didn’t support sha512 (nor does the new one). So I’m afraid it might be that the older windows clients could fall back to plain L2TP without IPsec (which would be worth testing - when one of the old WIndows client will be the only one connected, try /ip ipsec remote-peers print to see whether that PC’s public IP is in the list - if it is not, it is connected using a plain L2TP) while the new version does not permit the fallback.
So the next step is to set peer’s hash-algorithm to sha1, enc-algorithm to aes-256 and dh-group to modp2048 which are the strongest phase 1 algorithms proposed by the Windows client, which to my knowledge the older clients support too. This way, both old and new clients should get past phase 1, and the next thing may be to deal with will be the phase 2 proposal.