It is likely that all the queries from the VLAN clients are being shown as coming from the IP of the VLAN controller.