SSH Attempts from Public IP reaching TACACS Server, They Shouldn't!

Hello Network Folks,

​

I have an HPE MSR edge router that has an ACL on the VTY interface which permits only private IPs. However today I get an alarm from the TACACS server that there are too many failed auth attempts. So when I see the logs on the router I see failed auth attempts from 182.61.163.252 (China), when simply put these attempts should be dropped by the routerlike may other IPs by virtue of the ACL.

​

Am I going crazy! what am I missing?