What I mean is I want to verify that the number of share submissions made to a particular pool are actually being processed by that pools bitcoin core and that they are not forwarded onto another service.
i.e. spoofing until a suitable share size is found
for example
Miner 1 connects to Pool A
Pool A's software processes the request from Miner 1 for a get block template, now rather than issuing the block itself from its own bitcoin core, it goes off to another service that lets say is paying PPNLS and requests the block from there.
Miner 1 is none the wiser as to where the block template came from, so it hashes the block and reports the share back to Pool A. Meanwhile the PPLNS pool is none the wiser either since the get block template request would look properly formatted as though it was from a miner.
Pool A's software looks at the returned share value and if its below a given threshold it returns the block to the other PPLNS service, thereby Pool A is earning a fee from the work done by Miner1
This is a widely used approach, many small pools (don't want to name them but they are obvious

) don't mine their own blocks, they just act as a proxy, most of those pools provide PPS payments and charge some good fee while having deals with larges pools like Viabtc, they do not trick Viabtc, they actually have a deal, miner 1, doesn't care because the proxy pool pay them what they promised to pay.
Now, lets say that Miner 1 is lucky and the share value it submits to Pool A is greater than network difficulty i.e. its found a block.
Pool A's software instead of forwarding the result to the PPLNS service instead returns the block to its own bitcoin core, thereby winning the block and Pool A's owner gets their 0.5-2% block fees while the PPLNS service looses out on the block rewards.
Nah, this can't happen, the getblocktemplate is generated by the PPLNS pool, miner 1 hashes the PPLNS payment address (coinbase transaction) inside the block they hashing, this can't be changed because it's in the Merkle tree, if pool 1 changes the coinbase transaction AFTER miner 1 submits the share, the whole block will be rejected by the network.
What you need to understand is that once something is hashed, there is no going back, so pool 1 is forced to either send the work with the PPLNS service address or his own address, if it's his own address then the PPLNS pool will not reward him for any shares because those shares will be invalid, so it's not like pool 1 can know before hand "oh the next share is going to win a block, let me put my address in the coinbase transaction" nah, no , nop this can't happen.
Pool A's software rejects the share and spoofs the whole block for itself under the guise of a different address and Miner 1 looses out as Pool A's software has essentially stolen the block.
Nop, can't happen. Refer to my previous answer.
edit: I tried a short and sweet explanation. if that doesn't cut it, let me know. I will do a long, boring explanation to show you how whatever you think is happening is impossible.