I assume all of the IP addresses are for sites that are not on your local network? I would expect this since the end point is going to use the router as it's next hop go out to the internet.If you were seeing an ARP spoof you would more likely see ...