I am looking at the POA logs and trying to find some
documentation on them and I can not find anything relevant.

There are certain entries that confuse me and I would
greatly appreciate any help.

For example what is going on here:

19:08:02 784 C/S Login Windows ::GW Id=user2 (user1) :: INTERNAL_IP [::ffff:EXTERNAL_IP]
19:08:07 784 C/S Login Windows ::GW Id=user3 (user1) :: INTERNAL_IP [::ffff:EXTERNAL_IP]
19:08:14 720 C/S Login Windows ::GW Id=user4 (user1) :: INTERNAL_IP [::ffff:EXTERNAL_IP]
19:08:27 720 C/S Login Windows ::GW Id=user5 (user1) :: INTERNAL_IP [::ffff:EXTERNAL_IP]

I am not sure what is second username between () I know user1 is logged in
from remote location from earlier entries but I am not sure what is he doing.

To further confuse things I have log entry from earlier in the same day

16:45:40 864 C/S Login Windows GW Id=user1 (user6) :: INTERNAL_IP [::ffff:EXTERNAL_IP]

There is a lot user1 activity by himself so I am pretty sure it is his doing
but having other usernames beside him makes little sense to me.

INTERNAL_IP [::ffff:EXTERNAL_IP] is always same set of IPs