If your tracking is set up correctly and there is no chance that there are any problems with it, here are some potential reasons:
You have a consent banner and you do not take consent declines into account in your calculations.
Your backend also receives orders from another source where your tracking does not work (e.g. orders added manually or renewal subscriptions etc).
Ad blockers. This is relevant if you do not use Custom Loader and the GA4 bypass function, or if your subdomain for sGTM is something like “sgtm” / “gtm” or something similar — ad blockers generally block these, so it is better to use something random as a subdomain for sGTM or use the same origin approach.