Fixed by exposing a configuration key to enable / disable dynamic role cleaning. Users having dynamic role mapping configured prior to 1.9.1 (without automated cleaning of groups) should enable the following in xwiki.properties :
xwiki.authentication.trusted.dynamicRole.clean=true