User showing succesful MFA-satisfied Microsoft login in random location with same device ID

Question

One of my users in Massachussetts has a sign in log located in KY randomly within her day. It shows as MFA requirement being met succesfully, and the device ID matches with her logs from her normal location.

I asked her if she used a VPN, or had any reason for this IP location to differ from her normal location. She told me she didn't use a VPN, but that during that time she was using her phone's mobile hotspot to work on her laptop.

I did some reading online and it seems that mobile hotspot IP addresses are not static, so it may not always show the correct location.

I just want to make sure we are not compromised. From what I've read and what she told me, it seems like when she used her mobile hotspot for internet to do work on her laptop, the IP address that was assigned was not local, and that's normal. Do I need to worry about anything here?