alexa-skills-kit-sdk-for-java | Alexa Skills Kit SDK for Java helps | AWS library

First, digital signature is NOT encryption with the privatekey; Amazon is deceiving you there, see https://security.stackexchange.com/questions/159282/can-openssl-decrypt-the-encrypted-signature-in-an-amazon-alexa-request-to-a-web which was basically the same question except without Java. And Java crypto exacerbates this because it was designed in the 1990s when this mistake was still fairly common, and as a result the Cipher object which is intended to be for encryption and decryption accepts the 'backwards' use of RSA keys and internally changes them to the operations used in the Signature scheme 'NoneWithRSA' (which might be considered a pseudo-scheme since it doesn't really match PKCS1).

Expanding on that point, the difference between your 'decrypted' (more properly, recovered) value and a simple hash is that the PKCS1v1 signature scheme used here, now retronymed RSASSA-PKCS1-v1_5 in PKCS1v2, actually has four steps:

#1 hash the data

#2 encode the hash value and algorithm in a DigestInfo ASN.1 structure encoded in DER, which amounts to adding a fixed prefix per algorithm

#3-5 prepend padding of the form 00 01 FF...(at least 8) 00

(8.2.1#2) treating the result as a number m, apply RSASP1 which does m ^ d mod n (or for verify 8.2.2#2 apply RSAVP1 which does s ^ e mod n; this is stated as before the three padding steps above but actually can just as well be after)

The backwards-Cipher operation performs, or reverses, only the third and fourth steps above; you have added the first step, but not the second, so your 'decrypted' value is actually a DigestInfo structure that contains some metadata, the OID for the SHA1 algorithm, and the hash value that should correspond to the data.

This failure to create or remove the DigestInfo structure is also a very common mistake and problem; see my list at https://crypto.stackexchange.com/questions/87006/why-is-data-signed-with-sha256-rsa-pkcs-and-digest-signed-with-rsa-pkcs-differen/#87022 .

But it doesn't match. The hash value embedded in the recovered DigestInfo is not the same as the hash value you computed on your data (and I also get). This strongly suggests some change between your data and the data the Amazon signed, but I have no idea what; certainly your data looks superficially like an Alexa request should. Sorry :-)