Scenario 16: Your monitoring detects the same refresh token being used from two different IP addresses within seconds of each other.

This is the signature of refresh token theft, detectable specifically because of refresh token ROTATION: if an old (already-used-and-replaced) refresh token is presented again, that's evidence someone else obtained a copy of it before or after the legitimate client rotated it. The correct response is to immediately invalidate the entire token family (every descendant token issued from that lineage) and force full re-authentication, rather than just rejecting the single reused token.