The created_at is set at the time the data is received by the ThingSpeak API server. If you are using MQTT, or static IP - which are essentially just forwarders to api.thingspeak.com, then created_at is when the data is received by api.thingspeak.com (not when it hits the MQTT or static IP).
Note that you can specify created_at as one of the parameters when you update the channel. This is particularly useful if your device has a real-time clock and you want to eliminate the network latencies from affecting when the data was actually recorded.
Note also that you can use the bulk ingest API to send data to ThingSpeak and in this case you can specify the timestamp of when the data was recorded. In this case ThingSpeak keeps the timestamp specified by you.
