When reviewing the License page tables and graphs the number of endpoints will be different compared to the CVS report.
Red Canary Licenses
The Graphs and tables for the licensing utilization represent the max active endpoints in the last 24 hours of data, the information for both gets updated daily. In contrast the CSV report will provide the last 30 days of data showing all the endpoints that have connected to the server during those 30 days.
This is by design and the difference between the values is expected.