Mulrtiple IP Addresses on failed sign in attempt

Hi All

I've been reviewing Bad Password Attempts on my work Azure AD tenant and I'm seeing a lot of bad password attempts in the Azure AD Connect Health - AD FS Services blade

For many of these failures there are 2 addresses (1 is external to my LAN and the other is a LAN IP - all the same due to the way that we NAT traffic)

My question is, what is the scenario that would show 2 IP addresses for a single sign-in attempt?

Thanks

Danny