If you're confident it is a botnet, why is it still allowed to use the pool?
Isn't that making you, in some small way, complicit in the misuse of other's resources?
I'm not confident. It could just be load balancing in the extreme with someone simply setting all his machines to 1% quota on this pool for dedicating a tiny amount of their hashrate towards solo mining and there's no way to tell them apart, and that is a valid use of hashes.