Remote connection showing up as from localhost on MariaDB 10.2
I would expect a connection to show as coming from localhost if a remote user was querying a table that has the federated, federatedX, connect or spider storage engines (or possible other similar storage engines), and the table was configured to connect as the root user to the local MariaDB instance rather than a remote one.

You can find the storage engine used for a particular table with:

SHOW TABLE STATUS WHERE Name='your_table_name';


You can also find tables using a particular storage engine with: 

SHOW TABLE STATUS WHERE Engine='name_of_engine';


You could also do something like:

SHOW TABLE STATUS WHERE Engine IN ('FEDERATED', 'FEDERATEDX', 'CONNECT', 'SPIDER');