There is nothing to worry about and nobody other than the one behind this and/or the NSA are able to answer this accurately. They could create a million nodes, it would make no difference. You are wasting your own time with these questions.
what happened?
See above.
is a group or someone trying to get >50% of all Full Nodes by setting up many new ones (hidden behind TOR)?
See above.
do many Full Node Op's switch to use TOR? why? amount of Full Nodes totally is stable? does somebody have more Data to look at?
See above.
I made a thread about something similar a couple years back. Somebody popped up a lot of (clearnet) nodes. At the time I was thinking that they're either trying to do a connection-exhaust attack or partitioning attack. I'm having trouble finding it right now. In practice, it usually creates a high cost for the attacker with very little to no gain.