Here is the explanation I received. Please let me know if there is a better way to understand this.
"The IP Phone can tag the packets with 802.1Q frames which means it can tag the packets with different VLAN. It learns its vlan through CDP. So when the switchport is defined with access vlan 10 and voice vlan 20, the phone sends voice packets with vlan 20 and data packets coming from the attached pc with vlan 10. In essence, IP phone acts as another switch to the catalyst switch and hence the trunk behavior on the port."
The reason you see both MAC addresses is because on that hardware for that switch, the MAC address of the CDP messages are counted. CDP traffic is not 802.1q tagged and goes to the native vlan. On othe hardware you will not see this because CDP traffic will not be shown on the port unless there is an problem with the IOS, as you have stated.
These are the paths to get to each CCX logs through CLI. They may be helpful if you are having issues accessing RTMT or downloading logs through it.
If you want to download them you have to prefix "file get " and you can add one of the options (re...