Find location of VPN connection

[baysys]

We have a web application firewall in place with GEO IP protect enabled. The GEO IP protection allows only traffic within Canada to our site. In Google analytics, it shows a connection from Asia. We tracked down that these connections are related to a client in Canada based on login name. We believe that the connection in Asia is bypassing the GEO IP protection using a VPN to this client’s network. Is there a method of proving this? Finding the VPN origin? Is there another way other than VPN? Any suggestions welcome. Thanks