Hi Philip,
did you specifiy SAP/Kerberos<SID>@<DOMAIN>" literally or did you replace it to keep the info private.
If the latter, you at least forgot to hide the sid completely ;-)
In you case I would have expected to see something like
CN=SAP/KerberosEQ1@<YOUR_AD_DOMAIN>
To my knowledge a system uses the same service principle for all instances. However the config has to be created for each one, just as outlined in your document.
Regards,
Patrick