In the audit logs, it's possible to see a similar notification:
User logged in from a location that is not possible to reach in the time since the last closed session. The user seems to have travelled x km (x mi) at a speed of x km/h (x MPH).
This audit log entry is determined by the geographic coordinates which are linked to the user's IP address. Over time, this may change.
The log entry is simply an indication that something may be suspicious.
It can also occur after the end user switches networks (e.g. landline / 4G / VPN / ...).