Ok. I believe the 172 is a private IP network, possibly from Cloudflare. This can mean the pages are being served by some proxy. Please note the Storefront merely reads the IP address of the incoming request and pass along to Authorize.net. It won't know that it's coming from a proxy or a real client.

Normal requests looks like this:

SERVER <=> END USER

Using a proxy in between:

SERVER <=> PROXY <=> END USER

Can you check with your hosting provider if they are somehow using a proxy to serve out the pages because that is the IP address read by the Web server from the incoming request? You can share those IP address with them and see if they recognize it. I think they may be using CDN (Content Delivery Network) like Cloudflare that reads your pages, caches them and serves the cached version to the end user. If that is the case, you can ask them to try disable the cache on the document, but only cache the static resources like images, etc.

Thank you