Could be a couple of reasons but it usually depends on the method in which the logs are collected.
If Splunk is receiving logs from a forwarder, then as soon as Splunk comes back on, the forwarder will forward these queued events with the timestamp of when the log was created.
You could have also had logs indexed during the uptime with a timestamp that is in the future.
Try looking at the _indextime of your logs
| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")