Are you reading the first IP of the returned array, which should be the client one?
const clientIp = (req.headers['x-forwarded-for'] || '').split(',')[0].trim()