There seems to be a confusion. The 3rd column shows the Source IP address of the syslog messages which is 10.168.1.20. If all the messages above are saved into 10.168.1.20.txt file then %IPAdd4 variable is working as expected. The 4th column contains the exact Syslog message, part of that message contains other network devices.
Hope that clarifies the situation.