how the RemoteIP associated with the SvcHost process can be spoofed
In TCP, you can't really spoof an IP address and use the connection. The TCP handshake requires a three way handshake where packets are exchanged between the two endpoints. If you have spoofed the remote IP address (i.e., written a fake or incorrect IP into the IP header) the handshake will fail. So, the bad actor client sends your servers spoofed packets (inbound SYN) your server replies with a SYN_ACK, but sends the SYN_ACK to some random place. If it arrives, the machine that receives it will wonder WTF this is doing randomly showing up there, and just discard it.
Spoofed IPs are useful for DDoS attacks (to hide the source), amplification (to bombard a target), etc...
But they are not useful if you're trying to get a connection and hide where you are.
Is there a way to detect if these IPs are spoofed?
Not really. The only time I have seen that it was easy to detect spoofed IP requests (or what I surmise are spoofed IP requests) are looking at a firewall where there is a burst of inbound SYN packets, which get a SYN_ACK sent out, but an ACK is never recieved).
Can an RDP connection be established via a spoofed IP?
Depends on your definition of spoofed IP. If you mean an IP address that is not associated with the attacker, then no.
If you mean an IP address that conceals an attacker, then yes. They can MiTM themselves, use VPNs, proxies, and a number of other technologies to obfuscate their actual IP addresses.
P.S. - One other thing that you need to be aware of in terms of "can a spoofed IP establish a connection" ... RDP uses crypto to secure the connection. This involves the exchange of keys in order to encrypt the data, which is another handshake that has to work. So, our TCP /IP setup requires a handshake. Key exchange for the crypto requires a handshake. You can't do all that with fake IPs. It has to be an actual machine that is ready, willing, and waiting to fulfill it's half of all the requests.
How reliable is the remote IP in Resource Monitor?
It's reading the IP address from the IP header of the traffic. So, it's as reliable as that header is.