What do you consider to be tolerable ROI? Express this in terms of unique IPs, cookies, browsers, referring URLs, conversions, money, or whatever you use to track your site's productivity. Anything beyond that might be fraudulent, or it might be nonconverting traffic. But ultimately you have to decide what you will put up with.