Too many opens: Apple Mail Privacy Protection loads images in advance, Gmail, Outlook.com and Yahoo fetch them through their own servers, and company filters open messages to check them. Too few opens: the recipient blocks images, reads in plain text, or reads a copy the image was already cached for.
HawkOpen gives each request a category, such as privacy proxy, proxy cache, security scanner or human, with the rule codes behind it. A verdict is at most “likely”, and a request with no clear signal stays unknown rather than human activity. Rules are versioned, and stored signals can be classified again when the rules improve.
In practice, look at opens and clicks classified as likely human activity together with replies, and do not treat any single open as proof.