That’s the way to go. CPackRPM is using rpmbuild command in order to create RPMs.
The default behavior of rpmbuild may depends on system specific RPM macros:
https://rpm-packaging-guide.github.io/#rpm-distribution-macros
which are not under CPackRPM control.
(re)defining your appropriate value may help as you see.
Same kind of solution for https://discourse.cmake.org/t/cpack-rpm-prebuild-jar-file-changes-checksum