Why do we see "ZOOM" application traffic being sourced from the customer's "PRISMA-Infrastructure" address space to public IP's on the internet?

Why do we see unexpected "ZOOM" application traffic being sourced from the customer's "PRISMA-Infrastructure" address space in their Prisma Access Environment to public IP's on the internet?

• Panorama managed Prisma Access
• Traffic Logs
• External Dynamic List
• ZOOM Application

1. When configuring External Dynamic Lists on the Prisma Mobile User Gateways. , Prisma Gateway Firewalls will use its loopback IP address (Loopback IP address will be assigned from the customer's Prisma Infra IP range) as a source to reach out to the EDL destinations.  This is expected behavior.
2. The two examples below are used to fetch the Zoom IP range. 
   1.  EDL_Zoom_US - https://assets.zoom.us/docs/ipranges/Zoom.txt (Frequency 5 minutes) 
   2.  EDL_ZoomCDN_US - https://assets.zoom.us/docs/ipranges/ZoomCDN.txt (Frequency Every 5 minutes)
3.  The snapshot of traffic logs shows source IP addresses (10.96.2.17,10.96.2.16,10.96.2.4) are the loopback IP addresses configured on customers' Prisma Gateways (source addresses would be part of "service infrastructure subnet") that are being used to fetch these Zoom EDLs with the application identified as "zoom-base".

The discussion above is centric to zoom application traffic.
The same logic is also applicable if the customer configures External Dynamic Lists on their Prisma Mobile User Gateways for other resources.