First question: are you sure the two tools are measuring the same thing? Most arguments end here.
Different tools define "session", "user" and "visit" differently. Session timeout durations differ, bot filtering methods differ, source attribution rules differ. You shouldn't expect two tools to show the same number, in fact if they do, I'd be suspicious.
For verification, check these in order:
Is the tag loading once per page? A double-loaded tag doubles visits and artificially lowers bounce rate. It's a very common mistake.
Is internal traffic excluded? If your own team's, agency's, and test environments' traffic is included in measurements, your numbers are inflated.
Is the bot filter on and actually working? Check for traffic spikes at odd hours, single-page views, or traffic coming from a single source.
Is the conversion event firing in the right place? On the "Thank You" page, or when the button is clicked? These measure different things; someone who clicks the button but drops off at checkout shouldn't count as a conversion.
And finally: do a test purchase and verify it shows up in the tracking. One end-to-end check wraps up faster than three months of arguing.