I guess what you are seeing is by design. The metalink has the checksum of the latest repomd.xml included, but also the checksums of the two repomd.xml before that. The goal is to redirect you to a mirror that is reasonable up to date. Due to size of the repository and the tiering it can take some time until all mirrors are synced. To distribute the load evenly on all mirrors we accept that sometimes you might hit an older mirror. Not totally out of date, but at least reasonable up to date.

There are mechanisms to make sure only up to date mirrors are valid if something important is being pushed to the mirrors. But normally, by design, we are aware that it might take some time for the updates to reach all mirrors and therefore we accept, for non-critical updates, that users might hit a mirror that is a bit older.

Closing this as I think it works as designed. Right now I have no idea how to handle this better based on the mirror network we have.