There are 2 places where leaks are occurring:

• IracCleanupKeyCommand is not sending the tombstone to the backup owners, which prevents the tombstones to be removed (it is a conditional remove to avoid removing incorrect tombstones, in case of conflicting remove operations)
• The remote site is storing the tombstone. The tombstone is required to detect the conflicts and they shouldn't be stored. They are never removed (except if a local remove operation happens or clear operation)