Just a quick check with other customers whether you've seen this anomoly. We have seen several devices (all windows phones) that show up in the user-table as the default-gateway IP address. Of course, this adversely affects service for users within that affected subnet.
We have since updated our "validuser" ACL to account for this, but I'm mainly concerned why we were seeing this in the first place and moreso what these windows phones are doing.
(Yes, we have a case opened.)
Anyone else seeing this?