I called our host support and asked them about this, trying to get the options set correctly. They enabled the x-forwarded-for header in Varnish and confirmed the web server's access log is now showing the correct visitor IP address instead of the local server's IP address, and then I chose that setting within the WF options, but it still doesn't report actual IPs.
We have 25 sites now that are all reporting incorrect information. What changed in WordFence and why? This is pretty frustrating.