Search Console says Couldn't fetch for a sitemap that loads fine

Check from the server side first, the way Google would see it:

curl -sI -A "Googlebot" https://example.com/sitemap-images.xml

You want a 200 status and an XML content type, for both GET and HEAD requests. Then check robots.txt has no Disallow rule matching your sitemap addresses. If all of that is fine, the problem isn't on your side.

All 200 and application/xml, nothing blocking. So it's Search Console?

Most likely. "Couldn't fetch" often appears straight after submitting, before Google has actually tried, especially if the sitemap addresses weren't live at the moment you submitted. It usually clears within a day. To speed it up, remove the sitemap in Search Console and submit it again, which triggers a fresh fetch. If it still fails after a couple of days with everything returning 200, check your firewall or CDN isn't blocking Google's IP ranges.