Yes, an event and a search query must have a matching userToken or the event will not be considered for Dynamic Re-Ranking (DRR).
To prevent malicious users from manipulating the ranking of your records, DRR also requires a distinct userToken per event policy.