I'd start with dumping the contents of the webhook calls to see which event is being triggered and for which activities. Strava sends a webhook for create, update, and delete. That will help determine if they're truly duplicate calls or if each one is unique in some way. You should only see a single create call. Depending on how many apps an athlete has connected and how those apps work, you may see multiple updates to an activity. The update call shows the fields which changed which might give you some hints.

Assuming they are actually duplicate calls, the next thing I'd do is confirm that you really are sending an HTTP 200 response and not some other response code, and that it is happening within 2 seconds. You can check that by using cURL to issue a fake request to your server and checking the response code and timing. Strava has an example cURL call on the webhooks documentation page (https://developers.strava.com/docs/webhooks/)

Finally, if you can confirm they are duplicates and you are sending an HTTP 200 response within 2 seconds, then I'd e-mail developers@strava to get some additional debug help.

Thanks for the help. My app responds within 100ms so that's fine, and it's a HTTP 200. Tested it with postman and all is good. I'll e-mail them since there's no help from Strava so far whatsoever.