so why math doesn't match? I got 28% less coins than I should...If that's ok then we have nothing to talk about
There are many reasons to have a variance and it's to be expected; unless averaged out over a longer period of time. One aspect, that hasn't been discussed much, is the quick block time / time for a given block to be found. These are not, in any way, each the biggest variable; but they large enough to consider and can add up.
--Even though the block target times are 30 seconds, sometimes blocks get found much quicker. This can be verified by some of the 50 UTC payouts mentioned along this thread. Where a single user on a pool got the entire payout. There were 200-400 other miners at the same time, yet 1 happened to submit a share.
--The difficulty of shares sent to a miner will vary based on the total Kh/s of the miner. Many now are probably running 64-128 Difficulty, if not higher. Here again, a block can be found where your miner submits no shares; or even just a couple shares. If the pool as a whole submits several thousand shares to your few; you will receive less coins for that particular block than would be predicted.
--IF miners are at key Kh/s mining rates, often times the miner may be right at a speed "Switch point" for difficulty. The pool may send a group of shares at 64 difficulty, which it determines come in too fast. The pool then sends 128 Kh/s shares to your miner; which for that period will submit 1/2 the "number" of shares total. If this slows down the received Kh/s too much; the pool will re-target 64 difficulty shares to your miner. During the time when a miner is getting the higher share difficulty; you may easily "miss" blocks without submitting. Even though a share is worth 2 times the amount.
-- Network latency can affect how much "time" you get process and submit a share. This latency also varies and can easily impact shares submitted for a given or several blocks. Here again, this will lower the actual payout vs. predicted (for those specific blocks)
These points above can happen quite often and dynamically. These few things can be significant factors for a large variance in "short-term sampling". These things apply to all miners and all pools; as well as all crypto coins. As well, these are irrespective of the "pool luck" and "orphans; yet can cause just as large (if not larger) change.
As an aside, orphans are something that happen from time to time on any coin as well. Also, Orphans are a bit more common with any type of higher N based coin. All pools are getting some orphans even nitro.
Having said that, it is still "not so good" to have nitro with a large portion of the net. Even if there is no malicious intent or outcomes, it is still best for no pool to be over 50%. Steps have already been taken and maybe more will be. I imagine as time goes by, this will be less of an issue / will resolve itself; to some degree.
Finally, I ran on Nitro and Leet both when I mined and they are reputable and legit. So, I would first look at some of the above points to resolve your shot-term variance.