Source is who sent the event to Log Insight. Hostname is the originator of the event. If the originator of the event is sending directly to Log Insight then the source and hostnames fields should be the same, which they are in your use-case. Source is resolved through DNS via Log Insight while hostname is whatever the source sends it as. In your case, it appears the source and hostname are always the same and they are changing between IP and FQDN. The time range of the delta appears to be 24 hours.
Can you go ahead and generate a support bundle and upload it per the directions here: http://kb.vmware.com/kb/1008525 (create a folder called hansdejongh)