Most likely it's a GeoIP lookup of the first IP observed to broadcast the transaction - which may or may not be the originating IP.