The only large ships that move in formation at thirty knots belong to navies.
The radar traces were published on a number of websites after the crash. Some my still be there. You will have to look for them.
Was a radar duct present? They are often called "summer ducts" because they tend to occur in...well, the summer. A duct significantly extends the radar horizon. They are so common that some navies deliberately modify their radars' signal characteristics to exploit them. I have yet to see any discussion of whether ducting was going on or not. That's something we need to nail down.
The only large ships that move in formation at thirty knots belong to navies.
If a duct was present, then significantly smaller targets could be detected--like cabin cruisers, for example.
Also, this tends to militate against these targets being submarines: submarines are designed for submerged speed, and travel well below 30 knots while surfaced.