The way difficulty changes work under Stratum has changed. You'll see rejects that are below difficulty if you use old software. They typically submit all work, because of the weird way this used to work with Stratum in the olden days. Old cgminer will have rejects, new cgminer will not. Not sure what the status is on stratum proxies.
Hmm.. I had cgminer 2.10.2 and upgraded to 2.10.5 and still get a lot of rejects (about 9%), although not from 'below difficulty' as an error, just 'rejects'. Running for a day with just the regular getwork server via the nginx/PHP proxy I use and I get nearly zero rejects. I will try again with direct from miner to the stratum proxy and see if it's my nginx/PHP proxy getting in the way. Pity it if is since it's SO useful for pool failovers and configurations and monitoring all miners at once.