The peaks made sense because they were coming from the GET request I made several times...however, I was not aware about it at that moment.
So, I have been consulting with my LoRa provider and we believe that KPN is posting a JSON or XML to the destination URL.
ThingSpeak is expecting a GET request.
We believe the only way to solve this is to have a server in the middle what will handle to incoming data from KPN, decode the HEX data and create a GET for ThingSpeak with the correct payload.