A Very Starange Behavior from CloudFlare IPs

[MEM-917]

Hi

I Have 2 different personal VPSes in the US and Austria with all possible different protocols.(Reality, WebSocket, gRPC, OpenVPN, Hysteria, and ....). Everything was all good until I checked the logs and saw that some WS connections had IPs that didn't originate from Iran(where all the users live) and belonged to NETCUP ISP.
After some digging, I noticed the problem is the source address. E.g. connections with the CloudFlare proxied domains and www[.]speedtest[.]net all the logs are as they should be with true source IP(client real IP) but when the address is sourceforge[.]net the registered IPs in the logs are all over the place(sometimes more than 20 IPs all from netcup).

Has anyone encountered this problem?(especially from other countries)

p.s. The problem is not WebSocket specific and gRPC has the same issue.