Pattern recognition. When you haves 10s to 100s of billions of hands on record it becomes easier to spot anomalies in player strategy that would imply collusion.

Eh?

Collusion over a very short period of time from specific (and easily changed) IPs can make a lot of shared money - it's not clear how (and even if) online poker sites would monitor this.

Collusion isn't that hard of a problem to tackle when people are colluding at a poker table as they act very differently to when they aren't. Since the poker site can see all the hands this becomes visible very easily.

They obviously won't catch all people colluding but they will catch most of them. And just changing IPs won't help much when they ban your account/payment details and you have to arrange another fake identity that checks out at a payment processor regularly.