SYSLOG over NAT wrong source in eventconsole

IP2 is where your cmk server receives the trap from after NAT on the Firewall. So cmk-server is working fine.

If you don’t like that, you could rewrite them back to the IP4 address with Event Console rules (Setup → Events → Event Console rule packs).