pfSense

Users that have been authenticated by the captive portal are added as ether pass rules to the 'cpzoneid_X_auth' anchor.

If the captive portal instance is disabled or removed those rules should also be removed but they are not.

That appears to be because the database containing the user list is unlinked before the rule removal function is run:
etc/inc/captiveportal.inc#L407

        /* remove old information */
        unlink_if_exists("{$g['vardb_path']}/captiveportal{$cpzone}.db");
        unlink_if_exists("{$g['vardb_path']}/captiveportal_radius_{$cpzone}.db");
        unlink_if_exists("{$g['vardb_path']}/captiveportal_{$cpzone}.rules");
        /* Release allocated pipes for this zone */
        $pipes_to_remove = captiveportal_free_dnrules();

        captiveportal_delete_rules($pipes_to_remove);

See: https://forum.netgate.com/topic/176400/anchor-rules/