Perhaps the distribution is multimodal, i.e. the distributions could be a sum of different conditions and hence multiple distributions, e.g. such as a system that is idle vs. a system that is doing heavy single file downloading vs. a system that is streaming requiring regular intervals of high data throughput. The time spaces between pings may also be important, and some information may be lost in the averaging.

Perhaps the distribution is multimodal, i.e. the distributions could be a sum of different conditions and hence multiple distributions, e.g. such as a system that is idle vs. a system that is doing heavy single file downloading vs. a system that is streaming requiring regular intervals of high data throughput. The time spaces between pings may also be important, and some Nyquist-limited information may be lost in inadequate sampling.

There is an additional post here about summing multiple exponent distributions. I could not comment on nor upvote that one, so I made this separate response. The point on multiple hops is very valid, and I would first try analyzing pings to the next immediate node.