The Server response to create_session includes the client IP as seen by the Server.
However, the behavior can be configured with the <client_identification> block within the configuration of the listening port.
See the inline comment in the factory configuration file for details.
In particular, you should add the "private" attribute to <client_identification>.

Moreover, I suppose that the IP address that you see is not the client address but an internal address on your side.
This can also be fixed by properly configuring the <client_identification> block.
In fact, even if not sent to the client, this IP is useful to identify the clients in the Server log file.