I have Mikrotik routerOS v4.16 with hotspot. I notice that in Winbox--> IP--->hotspot---> hosts , one of the mac address change his ip continously ( I think a program change his ip) but the same mac address is for an uthorized user and he is using the internet and he is taking one static ip. The internet is working normally but I don't who is this guy that steal the mac address changing his mac contiously to randon ips (hotspot ip , modem ip and other )

Is this is your same system with the external APs (192.168.1.100, etc)? Are you certain that the mac you are seeing is not your APs? I have some APs that did not show the client mac, but the AP mac instead. All the client ips showed as one mac address (the AP) in "/ip hotspot host". Could that be the challenge?

Is this is your same system with the external APs (192.168.1.100, etc)? Are you certain that the mac you are seeing is not your APs? I have some APs that did not show the client mac, but the AP mac instead. All the client ips showed as one mac address (the AP) in "/ip hotspot host". Could that be the challenge?

no, It is mac access of a client. I saw with my own eye in Winbox-->ip--->hotspot-->host ; the IP is changing to several IPs in short time. This client is connect via Ethernet station and that is connected to a router. I don't know if it is his station or router acting weird, or another one took his mac. There is two IPs in hosts (his static IP and it is marked AD and the changing IP with mark D.

Only two ips in "/ip hotspot host"? Both with the same mac address?

Is there more than one computer connected to the client router? If so, do you see any other mac addresses of computers behind the client router in the "/ip hotspot host" list?

Are there more radios connected to the hotspot router than you expect? I would want to determine how the "mac thief" is getting onto your network. In your case, it would almost certainly be another radio if it is not your customer's router.
/interface wireless registration-table

FYI: I used a setup like yours for a short while. I used a MT router as an access point on the hotspot localnet. I stopped because the duplicate mac addresses were difficult to control. Mine would show the AP router's mac address and one ip. When a client computer would connect to the AP, a second ip would be added to the host list with the same mac address.

Since I had "/ip hotspot addresses-per-mac=2", when another client computer would connect to the AP and request an ip address with dhcp, the original second ip would disappear, and the new client computer ip would appear. As my router got more customers, the ip would change faster, then customers started to complain that they were losing their connection to the internet after being connected for a few minutes. I set addresses-per-mac=250 and the complaints stopped. But I could not tell who was who by mac address. All ips showed the same mac address.

I have APs connected to the Mikrotik. I am not using the Mikrotik Wireless. The client has AP in client mode and it is connected to a router. The mac address is the mac address of the client AP.