Syslogs will come from the devices themselves.
In the case of MX's, the logs will source from the biggest #'d VLAN defined. For example, if you have 3 VLANs defined:
VLAN 10 - 10.10.10.1
VLAN 20 - 10.10.20.1
VLAN 30 - 10.10.30.1
Logs from this MX will source from VLAN 30.
Additionally, the dashboard itself can send syslog (think login attempts & the like); However, I've not mucked around with this at all.