I think you may have hit on something @Polyphemus .
Could I add to that suggestion because I was thinking the same. Can someone who is good at using the Google spreadsheet thing make collect together our posted upload download speeds and pings for the servers in tabulated form.
Hopefully we could compare the biggest spikes either up or down on any particular server to identify when additonal ‘server activity’ is taking place.
That would then point to the server with suspicious activity taking place.
It’s likely a large spike up or down from compared sets of data when all compared will show which server we need to look at more closely.
I shall try to make a start on this offline with Libre Office.
Edit update 17:55: to include colour on the potential BEST servers: My candidate would be 85671 which has a huge upload download data amount. Perhaps this as @Polyphemus suggests need examining more closely.
Incidently @Polyphemus you have the same data for me for 85671. But that doesn’t necessarily indicate alone if anything suspicious is active on that server unless we could compare for unusual activity spikes.
EDIT 2018/07/06 Apologies if I have confused anyone. I got in a bit of a muddle. Hope it hasn’t spoiled anyone’s enjoyment of the puzzle set. 