If you look at Monero pools you'll see lots of miners with hashrates equivalent to 20,000 CPU cores and more and it wouldn't be profitable for people to buy or rent that many CPU cores.
Can you please show two or three example, where this could/was be seen?
And please define "lots" so we understand, what you mean.
Check the stats of large Monero pools like this releativelly small Monero pool for example -
https://minergate.com - One user with almost 70kH/s and ten users all above 6kH/s. While large botnets don't even need to use pools as they can solo mine on each node in the botnet while the sum of their work would be enough to solo mine easily. As ten-thousand nodes hashing at 10H/s (say on a CPU's that could max 100H/s on average if dedicated) will find the same amount of blocks as one node hashing at 100kH/s.