Customer explained that it seems for only one device an alarm was cleared too early and all other devices do not show the issue.
I explained that I see a lot of events with 0xfff0001* and that most likely they have to verify the custom events for any issues.
Customer mentioned that, as all other devices do not show the issue and that the custom events therefore should work.
We checked together the events around the time of the "alarm create" and the "alarm clear". We were able to see that the following event shows that a trap was received by the exact time of the clear and that they need to check on the device or with a sniffer tool like WireShark on the trap itself, but Spectrum does only seem to react to the trap:
..."A bgpBackwardTransition trap has been received for this device. The peer router is , the current state is idle, and the LastError is 0.0.","0x220011","System","","","Rtr_Cisco","10"
Basically, after enabling the alarm events 0x1070x (Event tab -> Filter -> Event Type tab -> remove the 0x1070x events from the list) and sorting the events by time, customer was able to see that the alarm was cleared by a trap and not by any other functionality or procedure.