I’m still not sure how exactly this can happen but the only thing I can think of is a buggy or rogue relay sending you events with wrong ids. If you turn signature verification on and it stops happening then that’s probably it.