Back when Dynamics GP converted from the old 'Advanced Security' model to the current security role and task model, the security permissions assigned to users at that time were converted into 'custom' security roles and tasks that begin with CNV and then will have the name of the user and the name of the company for which it is for, as you mentioned.
I imagine for each user there is also a CNV / DEFAULTUSER as well for the permissions to modified/alternative forms and reports they had at that point as well.
If you don't need them any longer, similar to a custom security role or security task, you should be able to remove them, though I don't know of any script we have to do this in mass and we would always recommend that any changes are done within the GP application itself over through SQL directly.
The tables that should have this information are SY09000, SY09200, SY10550, SY10800. As always, make sure backups of the GP databases are done before any removal is done.
Thanks