Why Windows event forwarding works in “Collector initiated” and not in “source computer initiated”?

Question

I'm trying to enable Windows Event Forwarding by "source computer initiated" but it doesn't work.

Error from "Eventlog-ForwardingPlugin":

"Error code is 2150859027... The WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available. This is usually returned by a HTTP server that does not support the WS-Management protocol."

Or

“Error code 5. Access is denied”

Using Windows server 2012 (WEF) and Windows Server 2016 (WEC)

1. Firewall is down
2. WinRM service is up and listening on 5985
3. Both servers are in the same domain
4. Using "Collector initiated" method works great.

I appreciate any insight.