vCenter monitoring reporting all logins as source 127.0.0.1
vCenter Server 7.0U3
This an expected behavior all Vmware vim-java session are logged at localhost (127.0.0.1)
You can verify this on the vCenter itself in Monitor>Task and Events > Sessions