They do not "change from one week to another". They have changed, what, twice ever?
* AdoptOpenJDK releases that were notarized some months ago are no longer accepted by Apple since they made the rules even more stringent. I had releases accepted by Apple that are not accepted today using the same AdoptOpenJDK binaries.
* Apple's notarization rules are not global. There's whitelists for given companies/institutions/apps/files which means the same dylib might not have to be notarized by a bigger player but will have to be codesigned by you.
The above happened to me in the span of less than 3 months I think?
Indeed, the scripts I use per se to do the notarization are about the same as originally.
And I made a test about the non-global rules too (by trying to submit the same binary and getting rejected).
My notes are here: https://www.patreon.com/posts/34472331
You can take the same Apache-NetBeans-11.3-bin-macosx.dmg and see how you could submit it with your own key.
I guess there may be different rules on a .pkg vs .app in a DMG but it seems silly since the user gets the same bits on disk.