CIAs aren't installed to the NAND, they're installed to SD, so no need to worry about that.
As for "GBA firm modifications", can you explain/elaborate on that?
You can check differences between NAND dumps with SHA-256. If you use GodMode9, you can go to the NAND dump's location, press A, and press A on "Calculate SHA-256". This will take a while. Then go to a different NAND dump and calculate its SHA-256. If there are differences between the two, it will let you know.