Sounds like a scenario where changes are made to CALs but because the apply button wasn't clicked, when you go back to later, it seems like things changed back like your Person#1 and Person#2 example.
You can also enable QMC Audit logging to log when and who are changing settings in QMC.
Take a look at the "Management Service – QVManagementService.exe.config" section in the Server Reference manual (page 59) in my version.
QlikView Server in normal circumstances doesn't automatically remove CALs.
Check the QlikView Event log if there aren't any PGO errors.