There is some confusion here. Your provider states they respond to an INVITE with 401, but that is almost certainly an OUTBOUND call they are talking about, there should be no 401 auth process on an inbound call, and in fact the log lines show the inbound INVITE arriving successfully:
Executing [s@from-trunk-pjsip-aa:1]
The s shows that the provider does not send the DID as part of the INVITE, so you need to look at the rest of the INVITE headers and see if the DID is in there anywhere, or if there’s some other string that uniquely identifies the call to a specific DID. I’m not seeing it in the To header, what about the Contact header, does that string change with the DID being dialed?
You can easily browse the SIP traffic on your system with sngrep.