You are protecting your iOS and Android devices with the Web Security Service and you want to know how the device decides to which data center connect.
Mobile devices will resolve to either android.threatpulse.net or ios.threatpulse.net
The Web Security Service geolocates the device based on the IP of your DNS server. You can follow these steps to find out how this is decided:
The mobile device will connect to the nearest data center depending on the geolocation given for your DNS server.
If you want to know where are the data centers located, please refer to Data center IP addresses for Web Security Services