POA Access Log clarification

Hello -

I'm looking at a POA access log (set to normal logging) for a GW 8 POA. I'm just looking for clarification on a few of the differences of various entries:

First example:
07:55:40 616 C/S Login WebAccess ::GW Id=user1 :: 172.x.x.x [::ffff:172.x.x.x]
07:55:47 616 C/S Login WebAccess ::GW Id=user2 :: ::ffff:172.x.x.x

I understand the first entry is logging in to WebAccess and the first IP address is the client, and the 2nd is the server
But why does the 2nd entry not include a client IP address and I only see the server?

08:24:47 312 C/S Login Linux ::GW Id=user3 :: ::ffff:172.x.x.x

This entry says "Login Linux" and only includes the server IP address(no client). This particular user is definitely NOT logging in via a client running on the server itself and has no access to a Linux GW client - so I'm trying to figure out what exactly this entry means and how it is possible...

Any help would be appreciated!