Hi
As the source IP I find that strange as it would mean the collaborator could had used more like a Windows 365 service (Windows hosted in Azure) to access onedrive. (as the source IP from where the collaborator accessed the link is coming from a Microsoft datacenter)
If he indeed used that kind of VM to work on, the datacenter for such were randomly allocated depending on the load in the past, I can't tell for now. So it might explain why for South Korea.