Here's another approach at this answer. I don't think people here are aware of this feature - it's something within Windows where you can have Windows systems actually forward Event Logs to a central Windows Server, which would then be running the agent. It's kind of like doing agent less collection without SolarWinds having to build it into LEM directly. It can be complicated to set up and do reliably, but if you get it working, the event logs will end up on some central server.
As long as the forwarded logs are rolled up into the "Application" "Security" "System" (and other named logs) that LEM collects, they will automatically be picked up, and you'll see the DetectionIP change to the original source. If they get separated out or only appear in differently named logs, the LEM team would have to do some work to make it happen.
PS: I should mention, there are still benefits to using local collection with an agent - active response, USB defender, reliable encrypted communication, etc.