They are probably reusing a component that happens to sort its entries alphabetically, since that is most commonly the expected behaviour. If the form is configured in a CMS, whoever built it might not even know it’s happening and has entered the data properly, but it gets resorted in the presentation layer. It’s also not impossible that the behaviour of the component has changed at some point and this particular case didn’t have test coverage or wasn’t actually part of the specification.

We migrated to Matomo, which has very similar functionality as GA, but can be self hosted and is GDPR compatible. It can even be configured to run without consent since it doesn’t build a third party ad profile, which should actually improve the data coverage a bit.

The tracking API is a little different than GA so we had to redo some things to get all the events to trigger properly (especially for e-commerce), but for basic usage statistics it’s relatively plug and play in the tag manager.

https://matomo.org/