I can't recall any past threads on people finding some CO in their tanks. Nor talk about CO analyzers, whereas analyzing O2% in nitrox is often discussed. To be honest, I've never given it much thought as I always get fills from very reputable shops. And you can smell it. I would think this is the norm for most divers. Is it risky to not own a CO analyzer?
I don't have a CO analyzer but am in the process of setting up my own compressor and fill station. I will be continuously monitoring for CO with that setup, with an alarm, so no need to check individual cylinders.
CO is toxic, on that we can all agree. As with all toxins, the dose makes the poison, and so it's: time x concentration x pressure in bar. It accumulates over, what, 30 days or so. As a result, healthy people can tolerate a short, acute dose.
In society at large, the trend is towards dumbing down the detectors to focus remediation efforts on very high concentrations. For household CO detectors, the latest standards require detectors to display "0" for levels below 30 ppm and to alarm only above 70 ppm.
Carbon monoxide detector - Wikipedia While this is at 1 bar, nonetheless, it illustrates that it is mainly the very high levels that are of concern. 400 ppm is considered non-hazardous for a brief exposure. OSHA regulations set a limit of 35 ppm for the average over an 8 hour shift for occupational exposures.
The point being that a 5-10 ppm level in a dive cylinder, even adjusted for hyperbaric exposure, is probably not something to be too concerned about.
That said, there have been fatalities, and there is the open question of the extent to which CO-contaminated breathing gas has contributed to fatalities previously categorized as "medical event." The data is thin.
Finally, there is no reason why a properly configured fill station should produce more than 1 ppm of CO. Hopcalite is highly effective in converting CO to CO2, and there should be some of it in every filter stack. Even on a Rix.