Bot collected mons aren't going to function anymore
Per nianticGeorge on TSR:
""With the announcement of Raid Battles and the new battle features, we are staying true on our commitment to ensuring that Pokémon GO continues to be a fun and fair experience for all Trainers. Starting today, Pokémon caught using third-party services that circumvent normal gameplay will appear marked with a slash in the inventory and may not behave as expected. We are humbled by the excitement for all the new features we announced yesterday.This is one small part of our continued commitment to maintaining the integrity of our community and delivering an amazing Pokémon GO experience."""
https://www.reddit.com/r/TheSilphRoad/comments/6ihyl6/update_on_pok%C3%A9mon_caught_using_thirdparty/
Answers
My guess is spoofing is different from how they catch these. I would guess that they use old APK to differentiate bot collected mons in a similar fashion that they used it for other anti cheating purposes. But I'm not sure.
But since many spoofers are also probably utilizing bots too it will mean something to do it anyway.
Even without evaluation of historic tracking data they could do statistics for amount of pokemon catched and amount of great IV great type Pokemon one player has.
If there is a chance of less then 1 in 1 billion all those pokemon are found by internal tracker only, (p.ex. 5 100%IV Dragonite encountered wild for a level 30 player) they could find a conclusion and an appropriate reaction.
It still remains hard to identify a specific illigal pokemon this way.