Right, if the chaincode only writes to the collection namespace, you only need to meet the collection endorsement policy.

Turning on full debug may provide a hint as to why a signature may be invalid:
FABRIC_LOGGING_SPEC=debug

Compare the debug processing of the valid and the invalid transaction.

Are you able to reproduce the problem when using the Test Network?
https://hyperledger-fabric.readthedocs.io/en/master/test_network.html


Dave Enyeart