You are correct, normally a record that is dropped from a net-change data file will result in it being deleted or de-activated in the zone by following net-change run.  However if there was a net-change setup run before the next ‘normal’ net-change than this wouldn’t happen.   This is because the net-change setup will delete the current net-change data repository and then re-populates it with zone values, but only for those records in the data file.  I’ve recently written an example for this scenario that may make this more clear.

EXAMPLE
====================
Day ‘X’
Data file:
— Records 1, 2, 3, 4  are present in the data file.
— For this example these records were in the previous day’s data file and their values are same as in that previous day’s file.

Net-change (‘normal’/ongoing/computation) runs.

Result:
— The net-change (normal) compares the data file to the net-change repository. Since they are the same no changes are sent to the zone and the net-change repository is also not-changed.
————-
Day ‘X+1’
Data file:
— A new data file with records 1, 2, and 3 that have the same values as the previous day’s file.  Record 4 is no longer present.

Net-change (normal) runs.

Result:
— Net-change sends a delete/de-activate to the zone for record 4 since it is not in the data import file but is present/active in the net-change repository.
— Net-change changes the net-change data repository to delete/de-activate record 4 to keep the repository consistent with the zone..
————-
Day ‘X+2’
Data file:
— A new data file with records 1 and 2 that have same values as in the previous day’s file.  Record 3 is no longer present in the data file..

Net-change Setup runs.
Net-change (normal) runs.

Result:
— The net-change setup clears the net-change repository and re-populates it with values from the zone.  The repository gets populated only for those records in the data file (records 1 and 2, but NOT record 3)
— The net-change (normal) compares the data file to the net-change repository. Since they are the same (remember, repository does not have record 3 in it due to the ‘setup’ run) no changes are sent to the zone and the net-change repository is also not-changed.
====================

As can be seen above, if a record (e.g., employee) is dropped from a data file, but there is a net-change setup run before the next ‘normal’ net-change then by design there is no delete/de-activate sent to the zone for the dropped record.

When I look in your zone via TCC console I do see that there were many employee net-change setups run in August and September.  To see this for yourself:

TCC
File > New > New Profile Wizard
Choose the endpoint for your zone (endpoint dropdown list)
Click ‘Next;
Click ‘Finish’
Near the top, click the icon with the blue-ish triangle (next to the pencil icon)
In the Identifier box, enter:   *NetChange-Setup*      (be sure to include the two  * )
Click the OK button (to run the query with this filter)

Note that there were 16 employee net-change setup runs from August 22 to September 26.  I suspect what happened for the ones that you found was that there was a net-change setup run using the data file with the dropped record before the the first time the normal net-change was run with the dropped record as in the above example.  Can you look at the timings of when the employees were dropped from the data file and compare to the net-change setup runs?