CEF event with syslog header gets device addres/hostname parsed wrong if CEF has dvc=entry

Hello, we have CheckPoint firewalls sending events over syslog in CEF format.
Problem is, that events has also the SYSLOG header containing deviceAddress. For ChceckPoints Identity Awareness events gets generated like this:

Jan 13 14:25:36 xx.xx.xx.xx CEF:1|Check Point|Identity Awareness|Check Point|Log|Log|Unknown|act=Log In cs3Label=Identity Type cs3=user cs5Label=Authentication Method cs5=User Identity Propagation deviceDirection=0 duser=User Name (username) dvc=xx.xx.xx.xx rt=1736774736000 sntdom=domena.corp suser=User Name (username) spriv=All Users logid=130000 loguid={0xhexhexhex,0xhexhexhex,0xhexhex,0xhexhex} origin=xx.xx.xx.xx originsicname=CN\=unGrlDG,O\=orgifm1.domena.corp.es56tu sequencenum=5 version=5 auth_status=Successful Login identity_src=Identity Collector (Active Directory) product=Identity Awareness snid=def0lf src=xx.xx.xx.xx

Where syslogHeader contains IPAddress of the box and is parsed as deviceAddress and dvc contains IPAddress of clientStation and gets parsed as deviceHostName.

Is there a way, how to preferably use the IPAddress from syslog header ONLY and just ommit the dvc=, so deviceHostName gets translated from original IPAddress in syslog header?

Have tried to play with destination settings Clear Host Names Same as IP Addresses and Set Host Names To IP Addresses When Unknown, but without success.

Or how to solve this riddle...?

Regards

Jan