[...]
a) some nodes are extremely more lucky than others. It means they get staking rewards much more often than others, regardless of their balance. I cannot be sure, but I assume those people were smart enough to modify the code somehow, and found a way to get more rewards than others. I suppose they are good programmers, and it is a challenge for a programmer to find the exploit they use.
b) the masternode payments are not enforced, so some stakers do not pay to masternodes at all. It could be either because their node is not reliably connected to the network, so it doesn't see masternodes, or because they modified the code to ignore the masternodes. By coincidence, most of those stakers are the most lucky ones

[...]
I have another theory, based purely on observation - and possibly a naive belief that people are good.
Used to run a number of masternodes, and a staking wallet. All on non-standard ports (ie. not 18888), and as time passed, "masternode list" would show fewer and fewer masternodes on the network, and consequently the same - this both on the masternodes and the staking node. Restarting would bring everyone back.
I never observed this behaviour on the masternode running on standard, 18888, and that one got many times more rewards than the other masternodes. Maybe it's as simple as the clients timing out, maybe they actively block masternode ip's.
I want to re-iterate that all this is speculation based on my own observations over time.
On another note, I'm very curious how these 2 masternodes can be "active":
"192.168.2.208:16666" : 100778,
"192.168.2.208:15555" : 86384,