What populates device_last_connected_source_city

[M.Bathgate]

What populates device_last_connected_source_city  field in the strata cloud manager , as presented via insights ?

On the main dashboard that shows the world map , it shows device locations , are those from client side GPS via the GP agent, or just the locations correlated by the ISP ownership of the presented IP address ?     It seems inconsistent , often grouping users to locations that arent where the users are ?    When i look at the raw data in device_last_connected_source_city   , sometimes that data isn't even populated and thus arent reflected on the dashboard map , hence question as to what and when is that information populated .

On the dashboard it seems to be some level of aggregated GPS position , though in the data from insights it only provides the "city" field , not any actual GPS .  Also strange that its city , seems more Region , as those in Towns are aggregated to closest region City or nothing.

Just after abit more info as to how this data is made up , so it can be determined if it can be used in threat modelling