Rather than guess I'd like to see the router configurations. Post the output of "/ip address print detail", "/ip route print detail", "/interface print", and "/ip firewall export" from each of the three routers, clearly labeling which configuration belongs to which router, and wrapping the output in
tags.
But a rough guess is that R3 doesn't have a route back to 10.1.1.0/24. When R2 pings it will use a source address on the network between R2 and R3, which R3 is directly connected to, so it can return traffic. NAT would cause the packets from R1 to be translated to an address on that shared network between R2 and R3, and cause pings to work. That would be the most obvious theory, and isn't contradicted by your diagram or details so far. You could test by simply inserting a static route to 10.1.1.0/24 via 10.0.9.1 on R3.