Kerberoast only what you can crack

Kerberoasting is only as good as the passwords behind the service accounts. Enumerate first, then request tickets for accounts that are likely to have weak, human chosen passwords, such as older service accounts.

Get-DomainUser -SPN | Where-Object { $_.pwdlastset -lt (Get-Date).AddYears(-2) }

Old pwdlastset plus a service principal name is the sweet spot. Roasting the whole domain just fills your queue with machine account tickets you will never crack.