let me share the case recently we've encountered recently. Customer were complaining about NTA reporting incorrect ToS information (CS0) from Cisco 4507, while packet capture on interface confirmed - in IP headers CS1 and CS4 are defined.
Despite this, packet capture on Orion server showed 0x70 value for ToS which is incorrect and that's why was transformed to default CS0.
Cisco TAC helped to demistify this: NetFlow support has hardware limitations for that planform, that restrict the platform support to a subset of all NetFlow fields. Specifically, TCP Flags and the ToS byte (DSCP) are not supported.