When removing packages, the deployment which contained the package, leaves a GUID as orphaned leftover.
Same goes for users, once removed in the IdentitySource, the user still is to be found in the Entitlement (might be a separate issue).
When removing a package you do get a notice that the package is in a deployment as relation, but then it does not clean up the leftovers in that specific deployment.