Since most paid wifi networks let you log in without a network password and then gate internet access by redirecting HTTP/DNS requests to a captive portal, it should be possible to launch an ARP spoofing attack [0] to impersonate the default gateway, causing all clients to route their traffic to your device, whereupon you can examine it with WireShark or tcpdump to get at their MAC addresses. I've tried something similar while bored on a flight, but sadly the Surface Pro 7's Windows network drivers don't seem to let you change your MAC address.