Not only are the timestamps in microseconds, they are meaningless outside of the gateway itself. The gateway just has a free-running 32 bit counter that is used so that downlinks can be programmed to send exactly 1, 2, (or for joins 5 or 6) seconds after the end of the corresponding uplink. If two gateways receive a packet, they’ll record entirely unrelated timestamps for it - the number is only useful to tell the same gateway to do something at a time relative to what it previously marked.
And that counter rolls over in a bit over an hour - which is why a request from the servers arriving at the gateway a bit over a second too late, gets recorded as too early - the next time the counter reaches the desired value would be over an hour into the future.