GA4 conversion/purchase tracking using Measurement Protocol results in source/medium "not set"

I'm trying to send purchases to GA4 using the Measurement Protocol API.

Here ist my request:

https://www.google-analytics.com/mp/collect?measurement_id=G-xxxxxxxxxx&api_secret=xxxxxxxxxxxxxxxxxxxxxx

array(4) {
  ["client_id"]=>
  string(20) "123456789.1691234567"
  ["non_personalized_ads"]=>
  bool(true)
  ["events"]=>
  array(1) {
    [0]=>
    array(2) {
      ["name"]=>
      string(8) "purchase"
      ["params"]=>
      array(12) {
        ["currency"]=>
        string(3) "EUR"
        ["transaction_id"]=>
        string(16) "123456"
        ["shipping"]=>
        float(6.9)
        ["tax"]=>
        float(4.81)
        ["value"]=>
        float(30.14)
        ["items"]=>
        array(1) {
          [0]=>
          array(6) {
            ["item_id"]=>
            string(11) "654321"
            ["item_name"]=>
            string(36) "Test-Item"
            ["item_brand"]=>
            string(9) "Test-Brand"
            ["price"]=>
            float(23.24)
            ["quantity"]=>
            float(1)
          }
        }
        ["engagement_time_msec"]=>
        int(1)
        ["session_id"]=>
        string(10) "1697002512"
      }
    }
  }
  ["timestamp_micros"]=>
  int(1697002689740112)
}

I'm extracting the client_id from the _ga-cookie and the session_id from the _ ga _[MeasurementId]-cookie like this:

_ga=GA1.1.123456789.1691234567 => client-id = 123456789.1691234567 _ga_xxxxxxxxxx=GS1.1.1697002512.2.1.1697001234.45.0.0 => session_id = 1697002512

Both cookies where initally set with the gtag.js from GA4, the user interacted with the page before.

The conversions show up in GA4, but no matter where the users came from, almost all of the turnover is assigned to source/medium "not set". Therefore, no conversions at all pop up in Google Ads.

Any idea what might be wrong? I sent the requests to /debug/mp/collect, but no problems or validationMessages where shown here. I'm a bit lost now where to continue to debug this stuff.

The session_id must be a number (int).