This might not be what you were trying to say, but it brings me to an interesting thought. Since you say 15%+ should be checked, would it be safe to say that 10% CPU usage, if these sites were to implement mining, would be acceptable to you?
I wouldn't mind a 10% CPU usage (as long as they inform everyone).
I agree though, more than 15% is certainly suspect, and if it is a consistent % of differing CPUs then it would seem that is a red-flag towards mining for sure. That might be a good test criteria, if you are suspicious of a site mining keep track of the % it uses of your CPU and compare it to another CPU, whether it be through another user or another one of your own devices. Would this work to any extent?
If by asking "if this works", you meant in terms of identifying their illegal usage of the CPU's, then the gathered information would be pretty much the same (that's why I mentioned checking the source codes [for accurate result]).