Do you use an external DNS when accessing your subdomain? I can only guess that it’s the DNS leaking it.

Sorry for the late answer, but will your SMTP logs show the original IP or the VPS’?

Ok for http trafic, but what about SMTP?

The problem with such a situation is that you have no idea of the origin IP address, as all the requests look like they are coming from your VPS. Did you find a way to restore origin IP in your logs?

Interested in learning about the wildcard. How do you set up the DNS to accept that?