Looks like you're using the hidden fields on the forms for capturing the lead source data. There may be a case where-in the content offer dowload form were submitted w/o any UTMs on the LP URL. Also, you probably wouldn't have the default values for the hidden UTM fields on the forms added, or else the default values would have been used for the form submissions w/o the respective utm param(s). Lastly, there could be a case where-in the proper UTM params were appended in the CTA URLs for the webinar registration which is why you're seeing the utm values for the webinar form fill activities. You can check the filled out form activities for both the cases (webinar and Content offer donwload form submissions) if they have utm query params or not.
... View more