Something is appending a charset=utf-8 to your intended content-type, in your code.
Which is invalid for the CLI and eventsub.
The API will only report that it failed, not why. Thats what the CLI is for in this case.
You could (in error) conceivable return the signature as JSON in error with a JSON header, when it should be plain text. So it’s a “make sure the dev didn’t make a mistake”
Verify needs 200 + the challenge in plain text
Events need 200 ok or 204 No Content. (No Content will mean no content-type header to muck about with)