You may have noticed that a deprovisioned user’s group memberships get reinstated, immediately after the object has been derprovisioned.
This is a product defect (TF00774332). This happens when the deprovisioned user object is not moved another OU and remains on the same OU as the original Group Membership AutoProvisioning policy is linked to.
Deprovisioned objects should be moved to another OU, where the original Group Membership AutoProvisioning policy is absent or blocked.
This will be fixed on the next maintenance release scheduled for early/mi June 2018. Please refer to this article for updates and/or contact support referencing the product defect: TF00774332.