blockchain.info seems to source transaction money from an address not in my wallet
It is likely that the address in question is a change address. Change addresses are generated using a different key derivation path than your other addresses so you will not see it if you only generated the keys at only one derivation path.

The "normal" key derivation path (a.k.a the "external keychain") is m/44'/0'/0'/i. However keys for change addresses are typically generated on a so called "internal keychain" which has a derivation path of m/44'/0'/1'/i. It is likely that you only looked at keys on the external keychain and not the internal keychain so you did not see this address.