Take a baseline of the Policies and Application configurations month-by-month, to identify which users are no longer in the AD but still referenced in the Citrix farm.
Any Group/User associated with the Policy/App that no longer exist will show as <Domain>\?.
This will also help to prevent your scheduled processing from failing.