It is possible that the service map misidentifies instrumented services as regular external nodes in the service map. This would occur if a span was included in an upstream path from a known service, but that service is missing from the set of service details data fetched along side the connection data. This might be due to missing metrics or sampled events for the service.

Suggested fix is to identify when a child span contains known APM fields (like service.agent) and be marked as a known APM service. Then the set of known APM services is used to fetch service details. The impact is that the service details would need to be fetch after the connection data rather than in parallel like it is currently, so investigate if there's a more performant solution than the suggestion first.