Ok thanks for pointing me to this link but elbereth said:
"The subver text version is retrieved by the port checker by connecting directly to the nodes and interacting on protocol level. This is retrieved every hour.
The protocol version is retrieved from the masternode list full.
If the masternode daemon was updated but without doing a masternode start the protocol version might still be the old one (70075 or 70076).
This does not mean they are faking v0.12."
I take it that it also means if a masternode deamon was updated to protocol 70103 but the masternodes haven't updated, that's why we see those masternodes still in the old versions?