sometimes there are tunnel interfaces that have rfc1918 IPs. so not a pod, and not the node ip. if this is in cloud, could be something related to that, though I haven’t noticed this type of thing in gke/eks/aks