Sharepoint - Remove users from People Picker - find where they are granted access

PeoplePicker uses three sources to find users:

• HiddenUserList of a SiteCollection (which you already found with MemberShipGroupID=0)
• SharePoint UserProfileService (which you already cleared)
• Finally it looks directly into ActiveDirectory

I think you have to limit the last step. You have different possibilities to filter what PeoplePicker receives from AD:

• Restrict People Picker to a certain OU. Problem: This is a "whitelist". You want to exclude one OU with a "blacklist". Might not work for you
• Filter Active Directory accounts by using LDAP queries. This is most flexible but you need to get a little knowledge about LDAP-Queries.