If we make assumption that the collection name is ips and the "CustomField" property is always being represented as "X-FORWARDED-FROM THE_IP_ADDRESS", then the following query aggregation gives the desired result:

db.ips.aggregate([{
    $project:{
        _id:{
            $substr:["$CustomField", 17, -1]
        }
    },
},{
    $project: {
      ip: {$split:["$_id", "."]}
    },
},{
    $project: {
      ip: {$slice:["$ip", 3]}
    },
}, {
    $project: {
      ip: {
        $reduce: {
          input: "$ip",
          initialValue: "",
          in: { $concat : ["$$value", "$$this", "."] }
        }
      }
    }
}, {
    $group:{
        _id: "$ip", count:{$sum:1}
    }
}, {
    $project: {
      _id:{$concat:["$_id", "0"]},
      count: 1
    }
}])  

It does the following aggregation:

1. Takes IP address from the string
2. Splits the string into arrays of 4 parts of IP address
3. Removes the last part from the array
4. Concatenates array elements into a string
5. Groups them by IP address
6. Finally concatenates "0" to the _id field as a last part of IP address

If X-FORWARDED-FROM string is fixed for every CustomField then can solve by using $substr.

db.CollectionName.aggregate([
    {$group:{
        _id:"$CustomField",
        count:{$sum:1}
        }
    },
    {$project:{
        _id: { $substr: [ "$_id", 17, -1] },
        count:1
        }
    }
])

where 17 means start from. that's the length of X-FORWARDED-FROM string

Updated:

db.CollectionName.aggregate([
    {$project:{
        ip: {$concat: [{ $substr: [ "$CustomField", 17,8] },'.0']}
        }
    },
    {$group:{
        _id:"$ip",
        count:{$sum:1}
        }
    }
])

for MongoDB 3.4 can use

db.CollectionName..aggregate([
    {$project:{
        ip:{ $split: [ { $substr: [ "$CustomField", 17,-1] }, "." ] }//ip: ["10","10","10","192"]
       }
    },
    {$project:{
        ip:{ $concat: [ 
            { $arrayElemAt: [ "$ip", 0 ] },
            " . ", 
            { $arrayElemAt: [ "$ip", 1 ] },
            ".",
            { $arrayElemAt: [ "$ip", 2 ] },
            ".0"
            ] }
       },
    },
    {$group:{
        _id:"$ip",
        count:{$sum:1}
        }
    }
])