Because the Discourse nginx is misconfigured, or the upstream proxy isn’t sending the appropriate headers to pass on the forwarded IP address. Without seeing the innards of your config, it’s impossible to know for sure.
I also noticed that I have a very limited range of Screened IPs (see screenshot below), so I wonder whether this points to a similar misconfiguration? The IPs of my users (registration, last IP address) are shown correctly, though. (But when people sign up via invite, their registration IP is not logged. I’m assuming that is by design.)
When you delete a user and say “ban IP”. You’re looking at what appears to be the default list. You either have a new site, never had a spam attack, or both.