@nick405060 Without your query, a log sample, and details about who made that admin webpage, I can only guess. However, I believe it may be looking at ip's of servers, instead of actual participants. Zoom has acknowledged they have servers in China. Here's only one link, but you can web search Zoom China and read up. https://techcrunch.com/2020/04/03/zoom-calls-routed-china/
You asked two distinct questions. I would also split this up here on Splunk Answers, and make a second question about RWI.
If this reply helps you, an upvote would be appreciated.