No WstxInputFactory is not the expected factory. The default one from java is com.sun.xml.internal.stream.XMLInputFactoryImpl. I think that the Wstx one you have is from woodstox-core Looking at the image it is version 5.0.3 from 2016, which has some bugs in this exact place.
Can you please check how that one got in? Are you using jackson-dataformat-xml by any chance? Are you using some cxf dependencies as well? Please check your dependency tree to verify why 5.0.3 is there and who is pulling it. Flowable doesn’t depend on that dependency.