Client bought spammy-ish links a while back - how safe are they?

I've had people say both sides, so I'm interested in getting you guys' opinions.

I'm working with someone who in the past bought links from a site called the HOTH, and now in their backlink portfolio has dozens of links from domains like: - relevantdomainkeyword.blogspot.com - keywordindustry.cabanova.com

They all have between 12-25 DA and link for direct anchor text for the keywords the page is ranking for. This to me is a big red flag, but the client says they experienced a marked increase in traffic since buying these links.

This isn't something I'd be super comfortable keeping, and I would have big worries that this would lead to a bad situation at some point in the future.

However, with disavowing becoming less in fashion as Google more dynamically detects unnatural links and discounts them, is it a problem? Should these links be removed, or can they be kept without too much worry for future penalty? I've heard both sides and I'm interested in what you guys think.