Marketo maintains a database of IP addresses and corresponding information for each of these IP's, so that it can populate the default segment information. Where does this information comes from is not very clear to me. I understand public Whois databases are a first source and that Marketo is building partnerships in various countries. But I do not know how they are cross-checking info or enhancing it.
For instance, I have experienced many times that the ISP filters are totally wrong in Europe.
I assume you referring to the pre-defined out of the box segments we create when you start an account, so you have some segments and visitors matching and meeting these criteria.
Firstly I would recommend, creating your own segments based on the use cases and business needs you have.
Such as what types of audiences you want to capture (match) when they come on your website and personalize content to them in real-time when if they meet the audience criteria you defined. See more in Docs here: RTP Segments - Marketo Docs - Product Docs
As to answer more directly your question, we identify your web visitors via reverse IP lookup to know their organization name and from that match the name with Marketo's proprietary data of firmographic details like industry. So if a visitor from an IP registered to Microsoft comes onto your website, we identify them as Microsoft and know they from the software and internet industry, and know other data points, and then in real-time can personalize content to them based on the segments you created. A visitor matches the segment when they meet the criteria you defined in the segment based on firmographic, location and behavioral attributes. In your case these visitors that matched the education industry, where visitors we identified coming from educational institutes, like schools, universities, colleges etc...