Discrepancies in Impressions and Clicks:
We subject all customer ads to automated scanning that can result in anywhere from 1 impression and click per day to dozens, depending on the automatically assessed risk level. Such scanning is done to ensure the safety of the internet public at large from malicious ads. Unfortunately, this activity does appear in third-party ad server logs and may appear in Google Analytics. Scan activity will be observed from a wide variety of geographies and devices. All stats in the DSP exclude automated scan activity, so no impressions or clicks as a result of this activity are billable.
In addition to our scans, exchanges or publishers may also subject ads to automated scans. This is outside of our control and is an expected part of participating in the RTB ecosystem. For example, Google will subject all creatives to automated scanning, which often shows up as robotic activity from Mountain View, California, but will not necessarily appear to be situated there. As with our own scans, we only bill for served impressions that result from an auction. We do not bill for invocations of customer ad markup that result from scans outside of the bid request/response cycle.
Clicks Without Impressions:
"Ghost clicks" may occur because clicks can come in some time after the impression. Imagine, for example, that somebody loads a page in a background tab and comes back to it days later. This could result in a click without any impressions.
The primary reason for the variance is that Google Analytics is not counting ad clicks. Google counts "sessions" (or page views), which is a different metric altogether. This means that a page needs to load completely in order for Google to register. Moreover, Google Analytics limits a "session" to every 30 minutes per user. Google Analytics and DFP discrepancies is a topic that is also recognized by Google and covered in their own support centre.
Lastly, there are a number of challenges that Google Analytics experiences around correctly attributing mobile traffic. Regarding mobile apps in particular, apps can't pass "referrers", which causes all app-based traffic to be under-reported and mis-categorized by Google Analytics.