Right, also the source IP of a port scan doesn't say anything about who has initiated that scan. If I were a state actor, I'd do my port scanning from machines in a different jurisdiction for sure.
No, you can't. They have a long, well-established history of concealing their undercover agents. The fact that this is not perfect doesn't mean that they don't make the effort, or that you're doing anything other than fooling yourself if you think that all traffic by a national intelligence agency comes from the netblocks assigned to those countries.