Requests to the OAuth callback endpoints should always be hex encoded, but it’s worth mentioning that hmac values for webhooks are base64 encoded (which this value looks to be).
You may want to check to make sure that a few webhooks aren’t sneaking into this route, but your assumption that OAuth hmac callbacks are hex values is correct.