source address showing up in wrong zone

Hi,

here is my filter condition

abc = company zone

--------------------------------------------------------

&

Source zone not in group("/all zones/cps")

Destination zone not in group("/all zones/cps")

Category Device group=/Firewall

------------------------------------------------------------

when i am using this filter i am getting events.

when i am inspecting the event i can see some source which should be in our company zone /abc  is showing up in other zone /Arcsight Systems

my question is why its not showing up in the right zone? IS it something wrong at connector? or something with the network modelling