Here the answer from one of our engineer:
'The "core switch" is probably an L3 switch, meaning it replaces MAC addresses.
So any traffic from end device to FGT through switch will arrive at FGT with switch MAC address.
There is nothing we can do, that's just what FGT picks up on.
If you have device detection enabled on FGT interface, then FGT will create a device entry based on switch MAC address.
o clear it, 'dia user device clear' removes all entries, 'dia user device list' lists the entries, and 'dia user device del <MAC address>' clears a single entry.'
Anthony-Fortinet Community Team.