This behavior comes from the syslog service which may not be splunk. Splunk's best practice is to use a system based syslog receiver such as rsyslog, syslogNG, kiwi_Syslog, etc. Then get splunk to index the files they produce. Both the sender syslog service and receiver can insert extra timestamps as they pass information.
The delay can come from a number of reasons. The most common is log cacheing. To save disk writes, a server stores log messages in memory until it has enough to make it worthwhile writing to disk. It can also come from network delays, an overly busy syslog service etc.
I would definately use the second timestamp as it is more likely to be when the event happened. If all your syslog messages are doing this, In your props.conf add the following to make splunk look after the ip address for the timestamp.
[syslog]
TIME_PREFIX = \d+\.\d+\.\d+\.\d+ \d+:
