Hi,
likely is is because syslog message does not contain year in timestamp, only month and day. Server uses current year when parsing. So most likely those messages was delayed by few seconds, and actual parsing happens after midnight, and server just use current year, which was just changed. Probably we have to add some check for it - like if resulting timestamp is one year in the future and current date is 01.01 then assume previous year.
Best regards,
Victor