For several decades, GNSS systems have been vulnerable to spoofing attacks, which have become increasingly sophisticated and difficult to detect. This article builds on collaborative detection methods, particularly the Collaboration-Enhanced Receiver Integrity Monitoring (CERIM), which generalizes the concept of Receiver Autonomous Integrity Monitoring (RAIM) for multiple receivers. CERIM detects measurement faults using residuals from Position, Velocity, and Time estimations. This paper extends CERIM enabling the identification of satellite failures or spoofing attempts through anomalies in the global monitor statistic derived from multiple receivers' residuals. Covariance matrices, essential for monitoring statistics, enhance the sensitivity of detecting system errors and malicious attacks. The literature on estimating these matrices is limited, often assuming unrealistic conditions such as receivers seeing the same number of satellites. This research addresses the challenge of estimating covariance matrices in scenarios where each receiver observes a variable number of satellites, leading to fluctuating dimensions over time. The study focuses on algorithms using both parity space and the complete satellite visibility space, known as Baseline and Common Residual algorithms. Two approaches for estimating covariance matrices are explored: the empirical approach and the theoretical approach. The empirical approach adjusts the matrices based on real data over time windows, accommodating the variable number of visible satellites. The theoretical approach uses classical variance estimations. Tests examine the impact of receiver proximity, comparing cases where receivers are far apart (over 50 km) and closely located (1-2 km). This comparison helps define geographical clusters for collaborative detection. Results indicate that the empirical approach is currently the most effective for anomaly detection, but it requires adaptation based on the number of visible satellites. A reflection on various spoofing attacks, from simple to sophisticated, aims to assess CERIM's performance, which is difficult to achieve with traditional individual methods. The innovation of this article lies in identifying the factors that enable accurate estimation of covariance matrices under various constraints, such as different masking (changing dimensions), as well as the influence of the distance between receivers, which allows for a good distribution of false alarm probabilities in the monitoring statistics. Additionally, the study also aims to determine if CERIM is capable of detecting spoofing on one or more receivers in the network, as the residuals from the positioning calculations increase significantly in the presence of spoofing and should therefore normally be reflected in CERIM.