Nobody bothers to do that kind of 'analysis', which is pretty much pointless. Those nodes are currently operating within the same chain so should not be causing problems (under normal circumstances). You don't have to worry about it. If you're running a node you can ban them for 1 year very simply.
There's no need to ban or worry if they split off to a different chain. That's the whole point of running a full node. You program the rules that your node accepts as valid, and blocks and transactions which break those rules are considered invalid. If a block has the correct proof of work and it's valid according to your rules, you accept it. If not, you don't.
There's no need to worry about what any other nodes you're connected to are doing, because everything is verified locally. 99% of the nodes you're connected to could be malicious and trying to fuck you over, but as long as you're connected to a single node who is relaying accurate information, you will stay up to date and have accurate information.
Worrying about who you're connected to is silly unless they are actively causing networking issues. Banning nodes you don't like is even more silly.