Prestashop don't care about nulled stuff but some module developpers can easily track their module with php.
so to minimize risk :
download module and test it on local without internet actived.
then look at the code source and search for keywords like "http://" or "https://" or "file_get_contents" or "curl" or "fopen" or 'developper_domain_name.com" etc etc...
if nothing is found, means probably no track system.
if something found, you need to read and understand part of code to see if it need to be commented
even a simple call to media (css,img...) hosted on the developper domain represent this risk.