Hello,
A few months back our website was hacked which we noticed quickly and got fixed. However, there still is a lot of dodgy backlinks, linking to the spam pages. They come up in Webmaster Tools, Moz and SEM rush.
According to the Moz Spam tool, a few of them have been given 7 flags which Moz suggests gives a 30% chance of being penalised by Google. The website has great rankings (position 1-3 in most targeted keywords) so I am scared of doing something that will harm the rankings, however I also aware that Google may do an update which could take these spam links into account. I have no experience of using the disavow tool but from reading up about it, it should only be used as a last resort. So my question is - what would you do?