As a result, analytics endpoints generally have some authentication and verification built into them. Obviously, with enough time it's possible to reverse engineer these components. But that's a lot of time and effort vs just blocking the request.
Personally, I just plop it into a "dead letter office" table, then verify it's not malicious. But it's possible other companies would handle this differently.