are those CALs locked to those users? --> Yes.
when will those CAL automaticly be dropped for a new user? --> never
can this only be done manually? --> Yes. Delete it. If the last access time > 24h then you can reuse it at once, else the cal is in quarantine for 24h, afterwards it is reusable.