Find Location Of Vpn Connection

We have a web application firewall in place with GEO IP protect enabled. The GEO IP protection allows only traffic within Canada to our site. In Google analytics, it shows a connection from Asia. We tracked down that these connections are related to a client in Canada based on login name. We believe that the connection in Asia is bypassing the GEO IP protection using a VPN to this client’s network. Is there a method of proving this? Finding the VPN origin? Is there another way other than VPN? Any suggestions welcome. Thanks

 

Can you clarify: "We tracked down that these connections are related to a client in Canada based on login name"?
Are you saying that a client in Canada has had their login compromised, so that someone in Asia is using to connect to the web application? If so, disable the account and advise the client to perform security scans on their devices and network. Then reset their password and enable 2FA.
Or is it a client employee on holiday or working in Asia connecting to the web application? This would appear to be a bona-fide use case for the web application. Why limit the web application use to Canada.

Is the architecture of your web application confined to be within Canadian national borders. Some cloud services, for example, have data centres that are across national boundaries and therefore connections could be made from those for client's within Canada.

Finally, there are methods that can identify VPN use, they might not always provide conclusive evidence, e.g., VPN & datacenter IPs Lists at https://github.com/X4BNet/lists_vpn. VPN providers continually add new IP addresses to bypass detection and increase obfuscation.