Finally, I found a Wiley PDF that is different when downloaded at the same time using different proxies proxy. Text and layout is identical and even the binary structure when downloading within 5 sec from the same IP. Using a different proxy, however, gives different strings at the end of the document.
So far I don’t know what these strings indicate, 32 letters are too short for something executable, but long enough to store some identifier or geolocation. Frequency analysis shows mainly e,d,c,a,f and digits eg hex code. Is it an IP6 IP address?
German Proxy 630d:577e:0c28:fe7c:3934:f08c:6ddb:a93e a3f4:840c:9efe:87b9:af97:df5c:2bf4:d9e6 Japanese Proxy db53:6013:615e:902a:805a:815c:229d:20da 7f46:ee57:fa4a:e3a9:33c2:c1db:37e3:ebb8 Dutch Proxy f2a7:8db4:dd89:2c4c:dfeb:d352:87e0:5c18 e606:c2e1:383a:bc21:ef35:58a1:6c54:a991
The length would fit an IP6 address. TBC.