We have not tested it over Eventbridge or HTTP. I noticed this issue first happening on a an old store(started around 2013). Note that not all orders had incorrect hmacs but a significant number of them had. I also checked some of the newer stores but this issue wasn't there apparently. So maybe this is only happening to older stores?
Interesting... I ask because there's an issue we're looking into regarding incorrect HMACs being sent only over EventBridge, but not Http delivery like your older store probably does. Something we need to look into. Thanks for letting us know!