Check out the optional Identity Awareness Agent software that can be loaded on problematic systems in your network that are roaming around or have local user switching situations, there is no way to detect these types of events purely from the network and software is required on the workstation to help out:
sk63920: Identity Awareness Agent for Mac OS X
sk107415: Check Point Identity Agent for Microsoft Windows 10
sk88520: Best Practices - Identity Awareness Large Scale Deployment
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com