[cma]

Wouldn't captured netflow data show which tor nodes users were connected to?

[_8j50]

Only entry guards which isn't secret info. You will need to get very lucky to correlate that with relay traffic with the guard. Even with decent 1:10 sampling I would say it us only a little better than a random guess at best.