While I agree you should not make rash decisions and jump out of your pool based on your payout dipping due to variance. There does seem to be some suspicious patterns occuring.
Also note that the share of network blocks turned in is 9% for two individual unidentified addresses, and 12% completely unknown to blockchain.info.
Obviously there are private players out there, but are they 21% of the actual hashing capacity?
Organofcorti does a lot of block solve analysis and identification of unknown hash power in his weekly reporting. You will find some answers to your questions there.
https://bitcointalk.org/index.php?topic=77000.0