Note that the port for the GUP is 2967 (unless configured otherwise). This indicates the source is a GUP.
Please do not get this confused with the section that indicates which server the client is checking into. A GUP cannot manage a client so you will still see it connecting to the Endpoint Protection Manager.
11/05 08:18:07  <GetFirstServer>
Using server x.x.x.x