It reads your own click log, not a vendor's guess
The tag captures the clicks that actually reached your site, tied to the gclid Google passed along. The suspicious list is built from that traffic: an address only appears if it clicked your ads, and outside signals such as a datacenter range, a Tor exit or a known-malicious list only add a reason to an address you already saw.