It appears that they are now filtering out requests that do not have a "valid" User-Agent. By adding a User-Agent from any popular browser, it should work. Other User-Agent strings may work too, like the default one sent by cURL (in my case "User-Agent: curl/8.0.1"). The example below is exactly the same as yours with the addition of a Firefox User-Agent header. It worked for me.
$oHTTP = ObjCreate("winhttp.winhttprequest.5.1")
$oHTTP.Open("GET","https://www.duolingo.com/2017-06-30/users?username=Marecustitus", False)
$oHTTP.SetRequestHeader("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0")
$oHTTP.Send()
consolewrite($oHTTP.ResponseText&@crlf)
consolewrite("http error: "&$oHTTP.Status&@crlf)
Console: (with redactions)
{"users":[{"joinedClassroomIds":[],"streak":160,"motivation":"brain","acquisitionSurveyReason":"friendsOrFamily","shouldForceConnectPhoneNumber":false,"picture":"redacted","learningLanguage":"en","hasFacebookId":false,"shakeToReportEnabled":null,"liveOpsFeatures":[],"canUseModerationTools":false,"id":000000000,"betaStatus":"INELIGIBLE","hasGoogleId":false,"privacySettings":[],"fromLanguage":"cs","hasRecentActivity15":false,"_achievements":[],"observedClassroomIds":[],"username":"redacted","bio":"","profileCountry":"CZ","globalAmbassadorStatus":{},"currentCourseId":"DUOLINGO_EN_CS","hasPhoneNumber":false,"creationDate":1619983341,"achievements":[],"hasPlus":false,"name":"redacted","roles":["users"],"classroomLeaderboardsEnabled":false,"emailVerified":false,"courses":[{"preload":false,"placementTestAvailable":false,"authorId":"duolingo","title":"English","learningLanguage":"en","xp":19391,"healthEnabled":true,"fromLanguage":"cs","crowns":52,"id":"DUOLINGO_EN_CS"}],"totalXp":19391,"streakData":{"currentStreak":{"startDate":"2022-10-15","length":160,"endDate":"2023-04-18"}}}]}
http error: 200