As you found out, this whole things is pretty unclear and it really depends on the phone/vendor (or combination vendor and software version) . While testing I've noticed some phones use their own MAC address every time (like my Nexus 5), while others change their MAC address.
Changing the MAC address doesn't really help if they send the full probe request though, as you can still use the combination of ESSIDs a device is looking for as a way of fingerprinting them (the chances of someone else asking for the exact same list are quite small).
Also, in one of the cases where I noticed a device using different MAC addresses, it only changed the last part of the address, keeping the vendor ID the same, making identifying a device easier.
I believe recent versions of IOS still do this in some form, but they use random MAC addresses. But even if recent devices don't send out probe requests anymore, there are still many older devices or devices with out-of-date OSes to make this work.
While testing I didn't really have a way see what percentage of devices around me sent probe request, but the absolute amount of devices is still high.
It is not so much about your device being at many places at the same time (though it is a nice side-effect) as it is about polluting tracking databases. If you normally have 10 people in an area, and all of a sudden there are 2000, you know something is wrong. But there is no telling which of these 2000 devices is the real one, meaning you have to accept false metrics, or remove all of them from your system (including the real device).
One of the things you'll need is a network card with the ability to go into monitor mode, which allows it to see all traffic instead of only traffic meant for your device. I don't think there are a lot of mobile phones that have such a card (the Nokia N900 did).
As you found out, this whole things is pretty unclear and it really depends on the phone/vendor (or combination vendor and software version) . While testing I've noticed some phones use their own MAC address every time (like my Nexus 5), while others change their MAC address. Changing the MAC address doesn't really help if they send the full probe request though, as you can still use the combination of ESSIDs a device is looking for as a way of fingerprinting them (the chances of someone else asking for the exact same list are quite small).
Also, in one of the cases where I noticed a device using different MAC addresses, it only changed the last part of the address, keeping the vendor ID the same, making identifying a device easier.