Why differents interfaces in logs that concern to one rule?

[LuisSP]

Saludos.... we have a 1490 smb appliance as perimeter firewall. Two devices at LAN (192.168.3.8, 192.168.3.9) connect to a server (13.82.177.x). ...but I have doubts about logs:

• even though each device connect to server more than once in a period of time, appliance only logs one time. I am sure that it makes more than one connection, because in each one,, an email is received, and I have the precaution of waiting to receive such email before "firing" another event that causes a connection 
• Why in the logs the interface WAN appears in one occasion and in another the LAN? randomly I do not think ... but I can not find the pattern !!

It is worth mentioning that the logs are saved in a sdcard memory inserted in the appliance, and recently had to be reinserted because the logs were not being saved.

Thanks!!