Summary
There are 3 reasons why there are less scans in your external analytics software than the total showing in your account.
Users scanning the QR Codes do not accept the consent box, mobile browsers block Google Analytics js snippet or the loading time of the scripts took too long.
Disable Consent Box
You can disable the consent box and compare the numbers again after some time (see 1 in figure below). Please be aware the in some countries it is not allowed to track users without their permission.
Increase the maximum script load time
The maximal default time of third party scripts to be loaded is 700ms. If it takes longer, the loading process is aborted and the user is redirected to the target URL. In case you know your target audience has a slow internet connection you might want to increase the loading time (see 2 in figure below), to make sure all devices have enough time to load the Google Analytic script before being redirected.
Check if GA script is blocked
You can scan a QR Code with your Smartphone and check if the scan is tracked with GA. However, you cannot influence the security settings of other phones. Other smartphones might block executing third party scripts.