motorhaven - 8:24 pm on Mar 25, 2012 (gmt 0)
Thanks for the tips so far.
Already found several valid exceptions to gzip/deflate, including Googlebot (from valid Google 66.249.x.x.), Yahoo, Bing, etc. This is my first phase of attack, whitelisting these.
I have pretty good set of PHP scripts I've written which do a lot of analyzing beyond just log files... it just seems to get overwhelming sometimes but I'll add much more to it based on the tips given here so far.