I don't understand the problem. You are asking where this traffic comes from?
[admin@MikroTik] > tool torch ether1 src-address=0.0.0.0/0
this will show you specifically which IP the traffic comes from
or better yet, use Torch in winbox, it's easier to use.