But are there any issues in using the Marketo URL for normal browsing?
Only if the browser has an anti-tracking plugin enabled (which would apply in normal mode, too).
Surprisingly I still have about a ~1.5%-1.8% discrepancy, probably slightly less than that. By and large the solution seems to be working so I'm not entirely sure if it's just an issue with a rogue page not having the correct code on it.
Thanks for the update, Navtej. Another possibility for the remaining discrep is that there's an anti-tracking plugin that's capable of detecting the CNAME to marketo.com (easy to figure out on the first hop, though they can't chase a long CNAME chain or it becomes a DoS against the plugin itself!).