...
Smaller pools tend to fly under the radar if they are doing something funky. etc.
...
I'd say that's just a guess?
... I can give very clear examples of exactly the opposite, that has happened.
During Nov-2017 my pool found two very high difficulty blocks in a run of 5 blocks, the two 875% and 928% - total for the 5 was 1936% yikes.
There was a factor of having around 50% of the pool hash rate coming from rental at the time.
To analyse this problem, I contacted a few of the largest miners on the pool (that represented a very large % of the pool hash rate), got them to check all their block find records in the systems they ran (and also in their miners) to make sure it matched the blocks they found on the pool, I wrote a second independent, accurate, binary block hash check from scratch and added it to my KDB code, then reran 3 months worth of the pool shares (I log all of them) through the code on another server, overlapping the time of the 'issue' to see if the front end pool code had somehow missed one or more blocks.
The result was: no it wasn't a problem from the pool's non-binary block hashing - being the last straw on the subject for me, I banned rental mining ever since.
Jul 2018, slush, who was much bigger, had a run of five blocks with a total worse value ... 2109% ...
https://bitcointalk.org/index.php?topic=1976.msg41534985#msg41534985Their response was effectively to ignore it:
https://bitcointalk.org/index.php?topic=1976.msg41900729#msg41900729Many of the following posts are about the 400PH miner who should have averaged about 2 blocks a day and the pool stats showed none by him, 8 days after the above bad run.
Their reply was that the stats are "For Fun"
https://bitcointalk.org/index.php?topic=1976.msg43143004#msg43143004