Those two messages arrived on the same server system, so our part of the
connection was the same. There is no reason to have on connection TLS 1
and the other TLS 1.2 without a misconfiguration at paypal's
maiservercluster.
Can anyone confirm similar sightings on your servers?