[JulianHart]

That's a Cloudflare IP — 173.245.x.x is their range. You're seeing Cloudflare's edge servers, not actual visitor IPs.

The multiple locations are just showing which Cloudflare POP handled each request (ORD, SJC, LAX = their data centers). That's expected behavior when you're proxied through CF.

Check the CF-Connecting-IP header to get the real visitor IP. What you're logging right now is basically "which Cloudflare server talked to your origin," not "where the bot actually is."