classic syslog has no timezone in the timestamp at all. device in +0300 sends a bare time, receiver assumes its own zone, everything is three hours out forever
store utc, convert on display, and for anything that cannot send an offset write its zone down in the config so the parser can correct it
Also worth separating the three things that all get called "the time": when it happened, when it arrived, and what the UI is showing you. Most confusion I have seen is somebody comparing the first on one source with the second on another.
classic syslog has no timezone in the timestamp at all. device in +0300 sends a bare time, receiver assumes its own zone, everything is three hours out forever
store utc, convert on display, and for anything that cannot send an offset write its zone down in the config so the parser can correct it