BTC - Mining Vulnerability and Future Consesus In order for changes to the Bitcoin protocol to be made, 95% consensus must be achieved, otherwise a hard fork would need to occur? Is this the primary reason why changes to the core protocol are so difficult to make?
With regards to consensus mechanism, moving aside whether PoW/PoS/Other is the proper solution, since the vast majority of voting belongs to large mining pools why would they ever vote for PoS or another non-mining solution? It seems even if a superior consensus mechanism exists it is highly doubtful BTC would ever deviate without a hard fork?
I've seen charts online breaking down the mining pool ownership percentage of BTC. I also know some pools have committed to cap their hash power and operations so as not to gain 51%. However, is it possible that a 51% attack could already be occurring and we have no idea? How do we know the mining operations aren't in collusion already and have not already been double spending, etc? If fraudulent activity occurs would we actually ever know?
Thanks!
In order for changes to the Bitcoin protocol to be made, 95% consensus must be achieved, otherwise a hard fork would need to occur? Is this the primary reason why changes to the core protocol are so difficult to make?

No. Changes are made regularly and you can subscribe to https://bitcoinops.org/en/newsletters/ for updates. Hard forks are not preferred to avoid chain split and other issues but can be used if it's really necessary. Some soft forks are contentious so consensus is a problem which can be solved each time with different solutions. BIP 9 was used for segwit so miners, voting and drama was involved: https://github.com/bitcoin/bips/blob/master/bip-0009.mediawiki
Taproot activation and consensus related discussion: https://www.reddit.com/r/Bitcoin/comments/hqzp14/technical_the_path_to_taproot_activation/

I've seen charts online breaking down the mining pool ownership percentage of BTC

I dont see anything wrong with this mining pool distriibution: https://i.ibb.co/pwxjvtc/image.png

However, is it possible that a 51% attack could already be occurring and we have no idea? How do we know the mining operations aren't in collusion already and have not already been double spending, etc? If fraudulent activity occurs would we actually ever know?

As Raghav mentioned there are lot of users keeping an eye on network activity. You should run your own full node and wait for more confirmations to finalize transactions if you think there is a possibility of miners trying to reorder history. Please refer to Greg Maxwell's thoughts on 51% attacks: https://www.reddit.com/r/Bitcoin/comments/ddddfl/question_on_the_vulnerability_of_bitcoin/f2g9e7b/
And also read about game theory involved in 51% attacks or any attacks on Bitcoin network:
Few things and one case mentioned by Jimmy Song - https://medium.com/@jimmysong/reorg-scenarios-binance-hack-edition-849fc7e7df07
Stratum V2: https://braiins.com/news/stratum-v2-bitcoin-decentralization
Jameson Lopp's thoughts about mining and decentralization: https://blog.lopp.net/are-chinese-miners-threat-bitcoin/