The substituted flag is set by the PI Data Archive when an existing event's value is changed.
For more information on the different flags, see the following KB article:
In this case, I would suspect that the files being fed to the UFL interface either contain duplicate rows or some data is contained in multiple files writing two different values with the same timestamp to this particular tag.
Also, what is the value of you /AM parameter:
/am=# Optional: Archive mode.
If the snapshot bypass feature is enabled (/lb), you can configure archive mode by setting this flag to the following values:
3: (ARCNOREPLACE) Add unless event(s) exist at same time (PI Data Archive 2.x)
4: (ARCAPPEND) Add event regardless of existing events
5: (ARCREPLACE) Default: Add event, replace if event at same time
6: (ARCREPLACEX) Replace existing event (fail if no event at time)
7: (ARCDELETE) Remove existing event
8: (ARCAPPENDX) Add event regardless of existing events, with no compression
This startup parameter does not apply when values sent to the PI Data Archive include annotations, because such values are sent using the PI SDK. If annotations are required and you need this feature, set Location5 for the target points.