There is a way to determine what proc a user actually used to signon with if a user uses the TSO full screen to change the TSO proc. When specifying the TSO proc on a TSO full screen logon ACF2 will create a GSO TSO record for that user that will contain full screen change information, including the TSOPROC.
To list the TSO record for a single logonid or all logonids the following commands can be issued from TSO, ACF:
TSO ACF SET CONTROL(TSO) LIST logonid or LIST LIKE(-)
The LOGON PROC name is in the Type 34 (TSO LOGOFF) SMF record in the STEPNAME(TIVINVNM) field. You can read your SMF records with SYNCSORT (SAS, or equivalent) select those records and then SORT/count that field.