Regarding your “another experiment” post, the Insteon Traffic tab of the SHN Utility is not a generalized Insteon traffic trace. That facility is there only to show the specific Insteon messages the Utility is issuing to perform a task by the Utility and the responses to those messages. The is showing this message was not the response to something the Utility initiated. Select the EZsrve/EZBrdge / Control tabs and view the Data Received window for a better look at Insteon traffic.
EDIT: the from ID: Insteon address tells you who the messages came from. Is that the address of the KPL or EZSrve?
EDIT2: the flag field (27) indicates an ACK from a DIRECT command. A KPL does not issue DIRECT commands in response to a button press. If the Macro is being triggered from a DIRECT command the If Device: Does: field content is in question.
EDIT3: I posted a document on the Wiki under EZSrve which has screen captures and XML trace samples. It uses an ICON switch as the Macro IF device but since you are using button 1 on the KPL the numbers should be the same.