users and groups not in the defined search path are being cached
Some users and groups not in the defined in the vas.conf search setting are being cached.
The user-search-path and group-search-path settings control where groups are initially pulled from during a join or flush however after that any request for a group will search the global catalog and pull in groups from wherever.
For example access control groups have no need of being in the search path.
Any by-name request for a group, either from configuration or nss, will be searched for everywhere in AD if its not already cached.