I've been trying to get into RNG so I think I can answer this from the mechanics side.
Every Pokemon has a hidden value called a PID and this value is directly linked to the Pokemon's exact IVs, nature, ability, shininess and gender. If any of these are modified, it will cause a PID mismatch and result in an invalid checksum, therefore an illegal Pokemon. The only way to avoid getting this warning is to replace the PID with one that has the IVs, nature, etc. you want, but that's easier said than done so most hackers don't bother. PKHex's legality checker is also much more complex than the official legality checkers in Home and Bank and will pick up on these things whereas the official ones will only respond to obvious hacks like unobtainable moves.