Splunk Linux TA - packages script, some hosts have time in the future

[splunk219783]

I'm running what I believe to be a somewhat standard input, from the Splunk Linux TA.  I just realized for some hosts the time is in the future.  All other time for logs from these hosts is correct,  only the package.sh output is 15 minutes in the future.

Time on the affected hosts is correct.  How can it have the wrong time when it was a script Splunk executed itself?

Input:

[script:///opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/package.sh]
sourcetype = package
source = package
interval =  86400
disabled = false
index = os

[codebuilder]

Have you checked to be sure the time zone set for your user matches the time zone on the server?

[splunk219783]

My timezone is set to default system timezone.

Looking at it now, it seems to primarily be one sourcetype mailog-too-small, but only on some hosts.

The event has the correct time, but the actual event time is 4 hours ahead.