This is common, if not a larger differential between the low and high values....I once saw a buddy's UPS report crazy fluctuations between 114-117V AC
They use the same parts (& basic design) as surge suppressors for that function; MOV's (Metal Oxide Varisistor). The overall amount of energy that can be handled should be listed in the specs.I'm hesitant to suggest counting on the average household UPS to provide true lightning protection when suddenly confronted by billions of joules of energy. Some components in UPSes are pretty cheaply made and low quality. Or over time, they may degrade providing less protection than expected. Then there's other things about how they're designed such as amount of time elapses before it stops the surge.
If you're paranoid, you can take a decent surge suppressor and then plug in the UPS. 😉 It could even increase the lifespan of the MOV's in the UPS, as the signal would hit the surge suppressor first. But MOV's can't help in the event of a sustained high voltage situation, and lightning strikes are rare, especially when compared to the occurance rate of brown-outs, where the UPS is what you need. 🙂
I look at it this way. Worst case, the UPS is far cheaper to replace than a system, especially if it's a workstation or server. 😀