Well, speaking from what I know about insim.
Each track is divided into a variety of nodes. The easiest way would be to listen to IS_MCI packets. After that, you'd have 2 options.
1) Cache the last_node of each PLID. When the node changes from the "prior" node to the "detection" node, get the speed and do whatever you want with it.
2) Check the X/Y/Z (probably just X/Y, except if you place a detection at the KY3 bridge or FE3/4 bridge) and if it falls into your desired range, check speed and do whatever you want.
I think you could read the layout as well for the cone objects that are currently on the track, but hard coded node/zone would work as well.
I see the node one being more reliable in case of dropped MCI packets, but the x/y one would be more "I wanna place a zone in an unusual spot".