Malicious Requests From Server IP

Thanks for your work on this plugin!

Was wondering why in the traffic inspector would show that malicious activity is only coming from my current session’s IP address which is showing as my server’s hostname. I have some 29 pages of activity like this that started 5 days ago. I have had to remove my server IP from the whitelisted IPs and can only log in by disabling cerber and then re-enabling it after login. Is there a better way I could be handling this or reconfiguring Cerber? Thanks!