Turns out those bogus 'false' city names were coming from PayPal's end; somehow they were occasionally dropping the shipping address city name that our card-based checkout form was submitting to them, and the IPN we later received from them confirming completed payment contained the value 'false' where they should have inserted the city name.
We've implemented a workaround where we briefly retain a copy of the original address information the buyer submitted in our checkout form, so whenever PayPal returns address_city='false' to us, we can just ignore that and substitute the city name originally submitted. I've asked Development to see if they have any way to rectify the city name in past affected orders' data in your transaction log and will do so if possible, but otherwise you can use this USPS ZIP code lookup tool to determine the city:
https://tools.usps.com/go/ZipLookupAction!input.action?mode=2
