SEC Sophosupdatemgr used instead of the real user

hi 

my users' internet activites are distorted. In log acces, i can see the user 'sophosupdatemgr' instead of my real user. Sophos crused the real identity of my users when they access to the web.

see:

http://img4.hostingpics.net/pics/146154Capturecp.png

I want to know why sophosupdatemgr user appear in my Checkpoint webaccess log and how to disable this function . I don't understand why this sophos user need to access on the web browsing of my users.

Web protection and Web Control are disable in my SEC policies ,and he still appear. Can i disable other functions?

Please, don't tell me to check this with Checkpoint.