FYI: you can't identify REFERER if...
 

if your visitors use Norton Internet Security/Norton Personal Firewall
in such case
instead of [HTTP_REFERER] => http://your-traffic-source.com
you get something like [HTTP_WEFERER] => CJVTLBXFGGMEPYOQKEDOTWFAOBUZXU
so your logs count a hit but the ref-source cannot be identified

do you know any other firewalls that block refs from being sent? :helpme

more info

I see blocked referers all the time in the logs, so probably it's not just Norton but some other software too that does that.

My guess would be that if the log has no referer that hit considered as bookmarked although some of them aren't actual bookmarks.