After moving the Exchange Servers behind a load balancer, the Origin value for events shows the Exchange Server itself rather than the true origin.
The load balancer is configured to hide the client's IP, which is a network-related issue. Change Auditor is not aware of this layer of configuration.
Please adjust the load balancer so that it does not hide the client's IP address. For instructions on how to accomplish this, please contact the support of your load balancer vendor.
