Intermittent QR Code Provisioning Failures with Identical Source Code

It's a bit of a slog, because Google choose to make it as difficult as possible, but on a failure there's an option in the Wizard (menu overflow) to send feedback. In that UI, the option to send system logs is available, and if you tap on the system logs link that shows it will take you to a window where you can scroll through the thousands of lines of logs the device generates. You may catch the issue there.

Simplistic question, but are you using admin_signature_checksum or package_checksum in your QR payload? I'd assume admin as this is sporadic rather than guaranteed after any update.

Do you have server logs from the host of the APK file? Is there any chance the network could be temperamental or inconsistently throwing a 4xx/5xx error?

If you were to host the file elsewhere, like S3, R2, or some other public CDN, can you replicate the issue?