I figured out the issue and I want to share my case.
When creating a service that exposes a pod as a LoadBalancer, aws creates a security group for this LoadBalancer and as the port exposed by my container was 80 so the security group allows requests from anywhere to this port, so I changed the security group.
as a takeaway, it's better to avoid using port ...
These requests are coming from your private network, not from the public internet.
172.20.76.173 is part of the 172.16.0.0/12 subnet, which is dedicated for private networks. See https://en.wikipedia.org/wiki/Private_network for more info.
Is it possible that the security policy that you created is only applied to the public interface, and not the private ...
In order to hide your IP address from users you need to make sure that they don't access your server directly, i.e. put some kind of reverse proxy in between. For public sites this can be done by putting a CDN like Cloudflare in front of it. For internally hosted sites this can by done by using services like ngrok or similar.