Maybe it's not malicious activity?  Maybe there's something wrong with some piece of software being used?

For example, I have a number of S1s running through a Stratum proxy.  How can I verify it's properly feeding random work to all the ants, and half of them aren't working on the same thing the other half are working on?

M