Unknown factor in bitcoin pool breakdown
It is unlikely that we will account for most of the activity, as Bitcoin allows for high anonymity. Some of that hashing power is believed to come from some botnet, but one can't be sure. You could try looking for the owners of the IPs that relay the new blocks and check who they are, but that would be a tedious work that could be easily hidden, for example by relaying blocks through TOR.