We have not tested it over Eventbridge or HTTP. I noticed this issue first happening on a an old store(started around 2013). Note that not all orders had incorrect hmacs but a significant number of them had. I also checked some of the newer stores but this issue wasn't there apparently. So maybe this is only happening to older stores?