Thinking about it more, I suspect the Wifi comes from a different IP block. The more likely answer is that Google developers screwed up, and made some normal,

Thinking about it more, I suspect the Wifi comes from a different IP block. The more likely answer is that Google developers screwed up, and made some normal, authorized, server access look like a user-level, unauthorized access. I still vote for upgrading to two-factor, and I agree with trying to get in touch with support at Google to have someone look at the logs.