The only reason of the IP leak we know of is a running NordVPN software with the Threat Protection feature turned on.
The Threat Protection feature has higher priority in the system and it makes every browser (including your regular browsers) use NordVPN's IP. It will work even if the VPN connection is disabled.
​
If you want to keep working in Gologin with a proxy, please turn the Threat Protection off to have it show the proper proxy IP.