The XRF works for a reasonable verification that parts are compliant.  It's not a pass/fail test, even though it gives that in the report.  You have to take into account that it takes the signal over the entire field of the aperture and to a depth that varies depending on the material.  So, you are averaging the Pb in the coating on the lead with the entire lead.  You can tell SnPb when the ratio of these 2 in the readout is about 2:1.  For instance, with only 2% Pb in a PCA sample, we could conclude it was SnPb used in the process because the Sn was about 4%.  If you're measuring 1000 ppm on the termination of a part, it's like well above that in the homogeneous material of the plating layer.  We have used Olympus hand-helds with the test stand with good results for component spot-checks and process area cross-contamination (such as in rework areas).  Our interpretation of RoHS 2 is that if you don't do any physical testing, you are not doing due diligence.  We have found the test swabs to only work at quite high Pb %.  I made some melted Pb-free solder buttons contaminated with SnPb and even at 5000 ppm, the swab didn't turn red.

Other elements that show up with an XRF and are a source of non-compliance:  Cd or Cr in colored wires or other plastics, Cr in chromate conversion coatings (the Chromate Check swabs from 3M work well to detect Cr+6 vs CrR+3).

You need to be trained on the use and interpretation of results.  We also find that you must check for the peaks in the spectra to confirm the element.