Source/Device info in logs

hi,

if im not mistaken, it comes from Device Detection, https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-Device-Detection-to-allow-FortiOS-to/ta-p/190901

can you share an example of a log where the log shows an ip and in fact has another ?

Is the device behind another router/firewall?

In the forward log the "source" column will show a user icon with a name and an ip address.  In the device column it has a windows logo with a different IP.