Check the AppSKey in the node. If the software requires you to define a sequence of bytes (like {0x11, 0x22, 0x33, ...} rather than some string "112233...") then also ensure you use the 0x prefix to tell it that the bytes are shown as hexadecimal. Maybe the software also requires you to reverse the order?
Why? As TTN is forwarding the data to the expected application, the gateway, NwkSKey and DevAddr are okay; see How does a network know a received packet is for them? But the payload itself is encrypted based on the AppSKey. Decrypting using a different key will simply show different results without any error. The encryption also takes the frame counter into account, which is why you see different values for different counter values. If you’d reset the node to make it start at zero again (and also reset the counters in TTN Console, or disable security there) then you’d see the very same sequences.