Pretty sure the traffic was masqueraded by the incorrect rule on that RB (172.26.157.161). It was masquerading WUG traffic incorrectly. So it looked like he was coming from that IP. To be doubly sure change his password. I’ve made a separate post about that RB and it’s innappropriate firewall rules.
Given that both RBs are including internet I will strongly suggest that you upgrade Yashiro’s RB to latest bugfix version or the current version of RouterOS. His current version is not secure (for example)