On SEP clients, it is seen that multiple definition folders can be seen, showing previous versions of the definitions. Normally these are deleted immediately after a new definition folder is created/downloaded.
This is working as designed in certain circumstances.
There are temp directories left behind when needed. These are used by post update callback and should be cleaned up over time.
In some cases, there are multiple SDS def sets. In the majority, all the def sets are in use by various components. This is not out of the ordinary. It's possible that the component was busy when it was asked to reload defs. In most cases, clean up will be attempted on the next update or reboot.