FG Report - Top Users by Sessions

Hi, recently turned on the report feature on our 200b to send us a weekly summary report.  The last two weeks I've noticed on the Top Users by Sessions there is an external IP making the top 10, all other IPs are (as expected) internal IPs.  We don't have any externally facing services that would warrant a lot of activity from outside in.

Is there any way to see why exactly this IP is registering so may sessions (2.1k)  I've searched all the logs and the IP doesn't come up anywhere, if it's just a case it is probing the WAN IP then that's obviously no problem but is there anyway to confirm that?

Many thanks

Gerry