it's populating from values provided by cloudflare. maybe that traffic from ID is always routed through SG?