It sounds like they’re coming in through account aggregation. When an entitlement is first aggregated during account aggregation because one or more accounts has that entitlement, it creates a “shell” of the entitlement with only the id value populated. This is typically a placeholder value until entitlement aggregation populates the rest of the data (name, description, etc.).
If this is what’s causing your issue, you have to solve it at the connector level via entitlement membership filters. This is not a universal feature across connectors, but for example, is supported in the Active Directory connector and the Entra ID connector after a recent update.