Has your SEO agency has been buying links from websites engaged in "Expired domain abuse" for PBN (Private Blog Network) creation? Expired domain abuse is something Google has announced they will be cracking down on in the forthcoming months in 2024.
Expired domain abuse "is where an expired domain name is purchased and repurposed [by building a new website] primarily to manipulate Search rankings by hosting content [often with external links] that provides little to no value to users".
Google have recently said in May 2024 that the "Expired domain abuse" update is not about links (stating that "Link spam is an entirely different policy") which to me does not make sense as many PBNs are site reputation abusers . This may be a more efficient way to target this type of spam (i.e. paid links) by identifying repurposed domains with low quality content and non-Google guideline compliant paid & sponsored links). From my perspective for example, if you have got links for your UK-targeted employment solicitor firm website from websites with domain names which suggest they are on an irrelevant topic (e.g. floridatourism .com , myweddingblog.com) or from lots of websites from foreign countries which have no relation to your content (e.g. feiertage .de - a German domain) then this activity may be considered to have the footprint of expired domain abuse.
If it's not clear you can see if the linking websites have been repurposed at some point by using the Wayback Machine to view previous snapshots of the websites in question over time: