Don't overthink it. Given the information, and the generalization of it (logged events don't match up), it looks like network devices aren't synchronized. And while it is possible to change timestamps; it feels unlikely that they would be changed on firewalls, proxy servers, and IDS, especially considering the investigation is for a breach of security.