Trace/block unwanted connection on my LAN?

By looking in my conn. trackers of several routers I discovered connections with src addresses belonging to Client private LAN’s (Like 192.168.1.x, default Wifi Routers AN’s)

Normally all these Wifi routers should do NAT and their WAN port would get a 192.168.50.xxx address from the Client CPE where the CPE always performs NAT as well.

All networks of CPE’s WAN ports and my routers are either in 172.25.48.0/20 or 10.50.48.0/20 range.

Now only some AP’s have a ether port connected to a house owners local Wfi router.
I think here the alien IP’s are coming from since I cannot use NAT for these in my router.

But the wifi router of that client is dhcp client and still gets 172.25.xxx.xxx address and is in NAT mode.

How come I still see 192.168.1.x in conn. tracker and all over my network?

Any suggestions, solutions?