Are you using any VPN clients? The Symantec VPN client shows up as a spoofed IP in the logs of my Linksys.