I've got the same problem. Found that restarting the forwarder tends to help, but not fully resolve the issue. For example, this morning we found a system doing this. Restarted the forwarder, and now about 50% of the events are right, and 50% are wrong...
... View more