sGTM produces vastly different geo-location data than Client side

Before we set a site live we run both client side and server side in situ to assess whether the migration is working correctly then switch over. with this website the Server side GTM shows regional data from geo-restricted regions in huge amounts e.g USA goes from 14th on the list to 1st see attached for more examples.

Due to this site operating in a restricted market, having somewhere which is meant to be restricted as the top location is troublesome.

The best hypothesis I have is that due to the geo restrictions people land on the website are blocked, they then switch to their VPN which allows them into the site, but sGTM carried the initial IP through the whole session.

I have no evidence to back this up which is why I am reaching out to know if anyone has any extra knowledge on the mechanisms behind sGTM implementation to prove, or disprove, this hypothesis.

Note: Cleient side is left, Server side is right

Do you use your own CDN or the same origin?
Is this data from GA4?