You're probably right about undercover saboteurs; they don't want to be caught with military/unusual equipment, so the use of normal phones/tablets and related apps makes sense. In doubt, the harm done by deleting those and similar marks if they're innocuous is nothing compared to the benefits if they're really made by saboteurs. Better they remove them ASAP and keep the attention for other that might surface. I'd also alert other maps service providers. If Ukraine still has enough control over the cellular network data, and Google degraded connections to their maps service in the area to plain http (so no port 443), deep packet inspection from the Ukrainian govt could reveal if someone is adding marks and near which tower.