You endpoint [redacted] does use a Real SSL Cert and not a self signed one?
A self signed may pass in the CLI as the certificate can be installed and trusted to the system and your CLI won’t be able to tell the difference, but a self signed won’t work for real eventsub.
Is your server/script logging the unbound requests from the internet (both at whatever is in front of your script and the script itself?)
Is your endpoint actually accessable publically? (Cli running on the same machine as the endpoint means it will naturally be accessable)