Our website was attacked with Japanese SEO Spam last year in October. We have now removed all the spam links from the database and website is secure. But Search console is still showing thousands of irrelevant links in search console which are crawled (but not indexed).
That sounds logical, Google found the URLs but decided against indexing them. It's the ideal result, rather than having thousands of spam pages indexed.
You've taken the correct steps in removing them from the website.
If you are worried about implications of them appearing, you can review the Manual Actions section within Google Search Console. This will inform you if any pages are not compliant.