The best of avoiding penalties for bad links from Google is to be proactive and cleanup. This needs to be done regularly, especially if the site is part of a large company that has several teams working on different sections. Here is a step by step method of identifying the links that need to be disavowed:
Export the list of links from Google Search Console, Ahrefs, SEMrush or any tools you have access to an excel spreadsheet.
Combine the entire set of links into a usable single excel sheet. This sheet is now your backlink profile.
The larger the site, the larger the amount of backlinks. Remove duplicates in excel so you only deal with the unique backlinks.
Once you have a clean sheet, import it into the link detox tool. This tool will acquire useful data for each link and compile it into one easy-to-use report. There are three features that help,For example, HTTP-Code lets you see the HTTP status code that is being output by the page the link is on. This way you can see if the site is still there, moved etc.Link Loc (or Link Location) tells you the location of the page it is on. This can be used to identify when some links have been bought.
The next phase is link removal. This involves contacting the sites that have those links and asking them to remove them. If that approach does not work then use the link disavow tools in Search Console and get those links disregarded.