Can you check the configuration of the windows event subscription using wecutil. You can dump the subscription config to XML using wecutil and share it here. I'm curious to see if Format has been set to Events or RenderedText. It should be RenderedText.
What Windows versions are used (remote servers and the collector machine)? (I saw a KB article affecting message on 2008.)
Can you please set include_xml: true in the config and collect an forwarded event. I'd like to see if RenderingInfo is included in the XML.
Then can you see try setting forwarded: false and see if that makes a difference. This would cause the message to be rendered on the collector machine using resources from the collector machine (this isn't always ideal because the collect machine doesn't necessarily have the same resources (DLLs, EXEs) as the machine that originated the event).