Welcome to the Q&A Forum

What an aggravating mess to have to clean up!

You're going to need to give Google stronger and less ambiguous directions for what to do with the offending domain. Right now, with the HTTPS version not redirecting properly, G is getting contradictory signals that will cause it to leave the HTTPS version in the index and prolong your issues.

The first step is to add an SSL certificate for the spam domain to the client's primary domain. I know this sounds counterintuitive, but it is required procedure in order for the redirect of the HTTPS version of the spam domain to work.

When a browser (or the Google crawler) tries to follow that HTTP redirect, the very first thing it must do is negotiate the connection. Because it's an HTTPS URL, that connection is going to fail because there is no SSL certificate present. Which means Googlebot can never get to the point where it can even see the 301 redirect. So Google thinks the spam domain is still active and leaves it in the index.

So step one is to get an SSL certificate for the www and non-www versions of the spam domain installed on the primary domain so the redirect will work.

The next step is to get the spam domain verified in its own Google Seach Console so that you can give Google direct instructions regarding what you want it to do with that domain.

Since you've deleted the spam domain's hosting, you'll need to Verify the spam domain in Google Search Console by using the DNS verification method where you add a TXT record to the spam domain's DNS records.

Once you have the spam domain verified and the HTTPS redirect is working properly, you can use the Change of Address tool in Search Console to point the spam domain to the primary domain. (The CoA tool must see a working 301 redirect in order to process the change.)

Note! At this point, I would use the Change of Address rather than the Remove URL tool in order to push any relevance signals of the spam domain to the primary instead of just dropping them altogether.

The additional benefit of the Change of Address is that the old spam domain will almost immediately drop out of the SERPs.

As a final step, it would be beneficial to get the individual spam URLs redirecting to their equivalents on the primary site. If the spam site used exactly the same URL structure, your domain redirect will take care of this. But otherwise, it would be beneficial to harvest as many of the spam URLs as possible and add 301 redirects for them into the htaccess file of the primary site. Again, we're trying to give Googlebot as many unambiguous signals as possible about what to do with the authority of those spam URLs.

Does that all make sense?