They have different meanings. From this doc:
Lock sessions to the IP address from which they originated
Determines whether user sessions are locked to the IP address from which the user logged in, helping to prevent unauthorized persons from hijacking a valid session.
Enforce login IP ranges on every request
Restricts the IP addresses from which users can access Salesforce to only the IP addresses defined in Login IP Ranges. If this setting is enabled, login IP ranges are enforced on each page request, including requests from client applications. If this setting isn’t enabled, login IP ranges are enforced only when a user logs in. This setting affects all user profiles that have login IP restrictions.
This means that the first setting will stop a potentially malicious user from using a sessionId to access SFDC from an IP address that is not the one from where the SessionID was originated (i.e.: log in).
The second setting, however, will restrict you from calling SFDC to the IP ranges specified. But there is nothing to stop another user in the same IP range to use a session that you opened (that's what the first setting is for). Depending on your whitelisting ranges, this could be a rather large problem, or an edge case.