When the web client or an AAPI CLI connect to Control-M/Enterprise Manager via an F5 load balancer, the Control-M Audit Report registers the login and logout entries with the load balancer IP address, rather than the web client or AAPI CLI IP address

The Control-M/Enterprise Manager web client and AAPI CLI are REST requests. They do not pass the IP addresses or hostnames of the client machines they are sent from, therefore the IP address that is registered in the audit report is the IP address that the request comes from, which is the F5 load balancer IP address.

There is no way to know the IP address behind the F5 load balancer due to how TCP/IP functions.