I'm using NetLimiter to prevent Windows Defender Updates and Windows Updates.
This detection struggles me a lot and I'm ending up with activating Shadow Defender then uninstalling NetLimiter, adding some microsoft entries on hosts file and hoping it doesn't waste my data for force updating some useless shit.
There are a lot of different ways to lag-switch both by hardware switches or routing through a Linux setup like PfSense.
Can't you prevent lag switching via freezing player like it happens on "I'm stuck" ?
Please remove this detection and maybe code some algorithm if you have free time, I'm not into MTA scripting but I want to suggest a possible algorithm:
Store players' average ping of 20 seconds,
If player's lag increased more than 100 from average don't store that as average ping and check these:
If player is a cop and in 100m range of a wanted player.
If player is wanted and in 500m range of a cop.
If player has /war ON.
If player got damaged by another player in last 5 seconds.
Also if, player gets x lag spikes in a limited time kick him for unstable connection.