SharePoint: Why are active users returned by GetNonImportedObjects?

(Get-spserviceapplication | ? {$_.typename -match "profile"}) | Set-SPProfileServiceApplication –PurgeNonImportedObjects $true

(Get-spserviceapplication | ? {$_.typename -match "profile"}) | Set-SPProfileServiceApplication -GetNonImportedObjects $true | out-file c:\NonImportedProfiles.txt

#Check which server has been running the AD import job:
$tjs = Get-SPTimerJob | ? {$_.displayname -match "ActiveDirectory"} 
foreach ($tj in $tjs)
{$tj.name
$tj.displayname
$tj.historyentries | select StartTime, EndTime, ServerName, status -first 10 | sort -Descending starttime}

#CheckNonImportedProfilesAgainstAD.ps1
#Author: Joroar
#Date: 9/3/2019
#Disclaimer: This PowerShell script is a SAMPLE only and comes with no warranties expressed or implied.  Use at your own risk.
#Summary: Takes output file from -GetNonImportedObjects and looks users up in Active Directory to see if they still exist and are active (not disabled) there.
#Limitations: 
#1: Currently this does NOT attempt any lookup for SAML or FBA users. Only Windows accounts.
#2: It only verifies the user can be found in AD and that it's not disabled.  Users are NOT validated against the LDAP filter and OU selection on the import connection.
#Instructions: Just provide your values for the infile and outfile files.
#$infile: The text file containing profiles to check.  This is typically the file output from Set-SPProfileServiceApplication -GetNonImportedObjects
#$outlog: Log file for the results
$infile = Get-Content "C:\NonImportedProfiles.txt"
$outlog = "C:\CheckNonImportedProfilesAgainstAD.log"
Set-Content -Value $null -Path $outlog
[array]$DCString = "DC="
$profileManager = [Microsoft.Office.Server.UserProfiles.UserProfileManager]([Microsoft.Office.Server.ServerContext]::Default)
IF(!$profileManager)
{Write-Host -ForegroundColor Red "Failed to get a connection to the User Profile Service Application.  Please make sure your account has Full Control in service app permissions."
Break}
FOREACH($line in $infile) 
{
$AccountName =""
$user = ""
IF($line -like "User*")
    {
    "----------------------------------------" | Out-file $outlog -Append
    $AccountName = ($line.Substring(5))
    #Check if non-Windows auth profile:
    IF($AccountName -like '*|*') 
        {"Doing nothing with Trusted Provider or FBA account since it may not be an AD user: " + $AccountName | Out-file $outlog -Append}
    ELSE{
    #Assume its a Windows account and look up the user profile in the UPA to get the DN
    TRY {$up = $profileManager.GetUserProfile($AccountName)}
    CATCH [system.Exception] 
    {"ERROR looking up profile for user: " + $AccountName + " -- " + $_.Exception.Message | out-file $outlog -append
    Continue
    }
        #Get the domain name from the DN so we look up the user in the correct domain.
        $SPSDN = $up["SPS-DistinguishedName"].value
        $Split = $SPSDN.split($DCstring,2,'NONE')
        $DomainDN = $split[1]
        $SAMname = $AccountName.split('\')[1]
        $Root = [adsi] "LDAP://DC=$DomainDN"
        #Connect to the domain
        $Searcher = new-object System.DirectoryServices.DirectorySearcher($root)
            IF(!$Searcher)
            {Write-host -ForegroundColor Red "Connection to $DomainDN failed.  Likely a permission problem"}
            #LDAP call to find the user in AD
            $Searcher.filter = "(&(objectClass=user)(sAMAccountName=$SAMName))"
            $user = $Searcher.FindOne()
                IF($user)
                {#Output the user details
                "Account Name: " + $AccountName | Out-file $outlog -Append
                "SamAccountName: " + $user.properties.samaccountname | Out-file $outlog -Append
                "SharePoint DN: " + $SPSDN | Out-file $outlog -Append
                "Active Directory DN: " + $user.properties.distinguishedname | Out-file $outlog -Append
                "Display Name: " + $user.properties.displayname | Out-file $outlog -Append
                "Email: " + $user.properties.mail | Out-file $outlog -Append
                $LNP = $user.Properties.lastknownparent
                "Last Known Parent: " + $LNP | Out-file $outlog -Append
                #Call out if Last Known Parent is set
                IF ($LNP)
                {write-host -ForegroundColor Magenta "LastKnownParent set for $AccountName"
                "WARNING: LastKnownParent set for: " + $AccountName + " --> Double check OU selection."| Out-file $outlog -Append}
                #Check if the user is disabled in AD
                $suser = [adsi]"LDAP://$($user.properties.item(""distinguishedname""))"
                $uac=$suser.psbase.invokeget("useraccountcontrol")
                    IF($uac -band 0x2)
                    {"Account is DISABLED" | Out-file $outlog -Append }
                    ELSE
                    {"Account is ACTIVE" | Out-file $outlog -Append }  
                }
                ELSE
                #User was not found in AD
                {"SharePoint DN: " + $SPSDN | Out-file $outlog -Append}
    }
    }
}

#CheckNonImportedProfilesAgainstAD-SingleDomain.ps1
#Author: Joroar
#Date: 9/3/2019
#Summary: Takes output from -GetNonImportedObjects and looks users up in Active Directory to see if they still exist and are active there
#Limitations: 
#1 - Currently this does not attempt any lookup for SAML or FBA users. Only Windows accounts.
#2 - This can only look up users in the local SharePoint forest.  If the users are in a trusted Forest, it will NOT find them.
#Instructions: Just provide your values for the input and outfile files
#$infile: The text file containing profiles to check.  This is typically the file output from Set-SPProfileServiceApplication -GetNonImportedObjects
#$outlog: Log file for the results
$infile = Get-Content "C:\NonImportedProfiles.txt"
$outlog = "C:\CheckNonImportedProfilesAgainstAD-SingleDomain.log"
Set-Content -Value $null -Path $outlog
foreach ($line in $infile) 
{
$AccountName = ""
$user = ""
IF($line -like "User*")
    {
    "----------------------------------------" | Out-file $outlog -Append
    $AccountName = ($line.Substring(5))
    #Check if non-Winodows auth profile
    IF($AccountName -like '*|*') 
        {"Doing nothing with Trusted Provider or FBA account: " + $AccountName | Out-file $outlog -Append}
    ELSE{
    #Assume its a Windows account and look up in AD
    $UserName = $AccountName.split('\')[1]
    $user = ([adsisearcher]"samAccountName=$($UserName)").FindOne()
        IF($user)
        {"Account Name: " + $AccountName | Out-file $outlog -Append
        "SamAccountName: " + $user.properties.samaccountname | Out-file $outlog -Append
        "Distinguished Name: " + $user.properties.distinguishedname | Out-file $outlog -Append
        "Display Name: " + $user.properties.displayname | Out-file $outlog -Append
        "Email: " + $user.properties.mail | Out-file $outlog -Append
        $LNP = $user.Properties.lastknownparent
        "Last Known Parent: " + $LNP | Out-file $outlog -Append
        #Call out if Last Known Parent is set
        IF ($LNP)
        {write-host -ForegroundColor Magenta "LastKnownParent set for $AccountName"
        "WARNING: LastKnownParent set for: " + $AccountName + " --> Double check OU selection."| Out-file $outlog -Append}
        $suser = [adsi]"LDAP://$($user.properties.item(""distinguishedname""))"
        $uac=$suser.psbase.invokeget("useraccountcontrol")
            IF($uac -band 0x2)
            {"Account is DISABLED" | Out-file $outlog -Append }
            ELSE
            {"Account is ACTIVE" | Out-file $outlog -Append }  
        }
        ELSE
        #User was not found in AD
        {"User " + $AccountName + " was NOT found in Active Directory. Likely deleted or in a remote Forest." | Out-file $outlog -Append }
        }
    }
}