This is a Nextcloud issue, in the way it forwards headers. See https://help.nextcloud.com/t/how-to-get-the-real-ips-in-logs... for the long thread