Hi thanks for the question
if you look very closely at the APIM test console in Az Portal you'll see a default checkbox which is unchecked next to the send and trace buttons "Bypass cors proxy"
By default the request sent are not from the browser but go via a cors proxy, if you resend the test but check "bypass cors proxy" you should see that x-forwarded-for is what you originally expected.
Hope this clears up the query