Having said that, other than our helper scripts, under the hood it's a default OpenVPN Debian install. So from my quick googling, once you revoke the user keys, that actually deletes the keys.

I'm guessing from your question that even after the keys have been revoked (essentially removing the user's access) that there is still some sort of profile that remains. Assuming that you know where it is, perhaps it's as simple as just deleting the relevant files.

I guess if all else fails, you can always read the upstream docs!?

Personally, in similar situations, I'm a big fan of testing this sort of stuff using a VM. If you want to test with real world data, you could do a TKLBAM restore. In this case, you probably don't even need to do that.

I would be inclined to set up a clean OpenVPN VM, get it running then add a couple of users, check they work, then remove one (as I hint above) and see what happens. If it breaks stuff for the other user, then you know that's bad. If it all checks out, then you can redo it on your production server.