I don't know how you calculated the "at_hash" from Access Token but I was able to create a hash string from Access Token with Python and google oauth2client library. This value is exactly the same as the value of at_hash included in ID Token.
I tested response_type=token id_token (OIDC Implicit Flow) with OTK 4.3.1 running on GW v9.4.
----
import hashlib
token_to_hash = "f8f5cadb-0901-40ec-9650-1dbcae313458" < This is the Access Token obtained from Authorization Server.
hash = hashlib.sha256(token_to_hash.encode('utf-8'))
digest = hash.digest()
digest_truncated = digest[:(len(digest)/2)]
import oauth2client
from oauth2client import _helpers
token_hash_computed = oauth2client._helpers._urlsafe_b64encode(digest_truncated)
print(token_hash_computed)
eRCpj2wcF9dD_0dWmps5Sg < This value is exactly the same as the value of at_hash included in ID Token
------