Pam. D Reporting Incorrect $Rhost in Script

I've implemented a login-notify script in /etc/ssh

The script will notify me via Microsoft Teams when there is a login to my VM, with the user, host and service

However - it appears the rhost is sometimes behind For example a user ssh'd onto the machine at 8:06, the ip reported was mine, and not his. Then at 10:06 i ssh'd onto the machine, and the ip reported was his and not mine - so it's as if the rhost is always one behind

Has anyone else had this issue? or know how to solve please?

EDIT - Here is the script

#!/bin/sh
if [ "$PAM_TYPE" != "close_session" ]; then
    host="`hostname`"
    curl -H "Content-Type: application/json" -d "{\"text\": \"SSH Login: User -'$PAM_USER' On - '$host' from $PAM_RHOST\"}" [MS_TEAMS_HOOK
fi