If the AD user was straight up deleted, when you run a Clean up job, the token will be unassigned from this no longer existing user.
You can run this clean up job manually, and individually check all the no longer existing users found and then click to unassign all the token, or you can schedule these jobs to automatically run every night or every few days or whatever, but with a grace period, because we have heard, very rare, but sometimes the AD Administrators mistakenly delete users ( yeah I know what you are thinking, that could never happen!) so if that has happened, you can wait a few days before unassigning those tokens.
If the AD people did delete a user, and then recreated the same user, the AM Identity source would still find that user even though their ObjectGUID had changed, because all the other information is the same, first and last name, UserID, DN.
