Sessions are opaque and stored server-side, so signing one out cuts access within the second instead of waiting for a token to expire.
The IP address is not shown upfront: you have to click "Show IP address". That click is itself recorded in the history, and the screen tells you so as you do it. It is personal data, including when it is your own.
The list shows at most four devices per member. If there are more, a line says how many are not shown: do not conclude from an absence that a device has signed out.
An unknown session should be revoked first, then followed by a password change : in that order.