Why would someone sybil attack when it's fairly easy to spot, other than to undermine knots legitimacy?
Allegedly, 19% of the bitcoin network is now running knots
However, I think I have detected evidence of a sybil attack designed to inflate the number of Knots users
I have annoted part of the "historical nodes" chart available at http://coin.dance/nodes/all
Based on this, I suspect the *real* percentage of Knots usage (subtracting probably sybils) is about 12.3% of the total network -- ~2,710 nodes out of 21,950 nodes.
Still a big deal, but not as big as the current numbers seem to suggest
Discussion
you have yourself identified a plausible explanation
an enemy of Knots might sybil Knots in order to make the node count numbers less reliable
a friend of Knots might do it to make the numbers look bigger, to spark a kind of bandwagon effect