1. It's great that you haven't been manually penalized! Unfortunately, yes I have seen pages drop off the map entirely before for specific keywords. Most keyword tracking tools only search the first 100 results, so if you don't make it inside that bubble it will display a null value like (--). It basically means you need to up your game. Most often you can make it well inside those first 100 results by applying on-site SEO tactics. Update your meta data, make sure relevant pages are linking internally to the page you're trying to rank, and improve the amount of unique quality content on page. Put some focus on the user experience.
2. You can disavow them, but I would strongly recommend you first check which ones are marked nofollow. You don't want to disavow those because they're already compliant with webmaster guidelines. For the rest, communicate with the bloggers you've paid and see if they can switch it to nofollow. Give them a couple of weeks. I don't think you need to jump straight to the disavow file if you can get a significant percentage of those links marked nofollow. I generally avoid using disavow files as much as possible because it's like the nuclear option. Last resort.
Moz has a pretty sweet tool with their spam score. I love how easy it makes it for the novice-intermediate SEOs to do a good job keeping their site quality up without needing a ton of oversight from a director or SEO manager. Check out Moz's article on spam score to get an idea how it works: https://moz.com/blog/spam-score-mozs-new-metric-to-measure-penalization-risk
I think if you have 4 or less that's pretty rock solid. It's an approximate value, so don't hyperventilate if you can't get it down to 0. Even this blog has a spam score of 1/17.