What should be done with links from the past that look risky?

Evaluate them first, do not delete them wholesale. Some old links from directories are harmless and removing them would only weaken the profile. For genuinely problematic sources we request removal and deal with the rest using the disavow tool. Always with documentation, so that it does not have to be done blindly all over again in a year.