Can I see which bitcoin node sent cli command If I am running a bitcoin node, and for example I run a sendtoaddress cli command, is it easy for anybody to see what IP that command came from initially
Yes, it is. If the node is running with -debug=rpc, then all RPC events will be logged, including RPC commands and where they came from.

Note that Bitcoin nodes do not communicate over RPC nor is the RPC interface typically exposed to the internet. Furthermore, the RPC interface is authenticated; connecting to it and being able to send a command requires knowing the username and password configured for that node.