This sounds about right. How would I go about figure out which addon might be causing this? Also, where are these patches located or are they included in the latest XF?If they only (and consistently) get that after logging in, then it sounds like there's an add-on at play.
However, if you are behind a reverse proxy system (such as CloudFlare) and you haven't applied patches to have XF use the real IP, it sounds like you've likely banned a proxy IP and some users are randomly (or not so randomly) using that IP.
I've went ahead added the CloudFlare IP script. Thanks!I would recommend disabling add-ons until it stops occurring. (Presuming that the add-on in question doesn't actually write to the ban cache.) You may also want to remove any banned/discouraged IPs that you have set.
Regarding CloudFlare IPs, this is something you need to do manually: https://support.cloudflare.com/hc/en-us/articles/200170736-How-do-I-restore-original-visitor-IP-with-XenForo-