Local IPs ( 10.60.0.0/24 ) in ClientIP field in OfficeActivity logs?

Started seeing this more often recently and it started to cause some uptick in alerts across multiple customers (we are an MSP). It seems to me like a backend workflow is failing to write true source...