If you have a device and web login on the same user, it could be that the user has logged in and changed his own time zone.
Time zone is overridden on user level, if the user has changed it from the Settings menu.
* There is a useful feature in SiteAdmin to login "impersonated". In the application list in SiteAdmin click on the icon left to the name of the application, then select the username to login as. In this way you can verify that a user gets the proper experience when logged in.