If the sync source is a PingDirectory server instance that has the Changelog Password Encryption plugin enabled, then you need to configure the PingDataSync server with the same key so that it can decrypt those passwords.
You can do this with a change like the following:
dsconfig set-global-sync-configuration-prop \
--set changelog-password-decryption-key:<this-is-the-key-you-want-to-use>