Don't work correctly with url containing "&"

I enabled SXG on the site: https://www.iltelegrafolivorno.it through Cloudflare.
In our site images are composed with this url:
i.e:
https://www.iltelegrafolivorno.it/immagini/?fmt=webp&url=http%3A%2F%2Fp1014p.quotidiano.net%3A80%2Fpolopoly_fs%2F1.7801291.1655663245%21%2FhttpImage%2Fimage.jpg_gen%2Fderivatives%2Fwidescreen%2Fimage.jpg&w=512

using the sxg-validator it return me an error in the cache:

returning:
199 - "debug: content has ingestion error: Error fetching resource: not found"

but if I check the cache directly it works:

ie:
https://www-iltelegrafolivorno-it.webpkgcache.com/doc/-/s/www.iltelegrafolivorno.it/immagini/?fmt=webp&url=http%3A%2F%2Fp1014p.quotidiano.net%3A80%2Fpolopoly_fs%2F1.7801291.1655663245%21%2FhttpImage%2Fimage.jpg_gen%2Fderivatives%2Fwidescreen%2Fimage.jpg&w=512

sh-3.2$ curl -siH 'Accept: application/signed-exchange;v=b3' https://www-iltelegrafolivorno-it.webpkgcache.com/doc/-/s/www.iltelegrafolivorno.it/immagini/?fmt=webp\&url=http%3A%2F%2Fp1014p.quotidiano.net%3A80%2Fpolopoly_fs%2F1.7801291.1655663245%21%2FhttpImage%2Fimage.jpg_gen%2Fderivatives%2Fwidescreen%2Fimage.jpg\&w=512
HTTP/2 200
nel: {"report_to":"nel","max_age":604800,"success_fraction":0.05}
report-to: {"group":"nel","max_age":604800,"endpoints":[{"url":"https://beacons.gcp.gvt2.com/nel/upload-nel"},{"url":"https://beacons.gvt2.com/nel/upload-nel"}]}
report-to: {"group":"webpkgcache-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/webpkgcache-team"}]}
accept-ranges: bytes
vary: Accept-Encoding
content-type: application/signed-exchange;v=b3
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/webpkgcache-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="webpkgcache-team"
content-length: 48603
date: Mon, 20 Jun 2022 09:38:19 GMT
expires: Mon, 20 Jun 2022 09:38:19 GMT
cache-control: private, max-age=601199
last-modified: Mon, 20 Jun 2022 09:19:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"