After dispossessing an NP-simulated pawn, it appears that the last frame of input is used for the continued simulation of the pawn.
For example, a client player may be holding down continuous input for the pawn to 'move forward'. If the pawn is un-possessed at this time, it will continue to move forward indefinitely or until possessed again.
Of note, the NP Prediction Component uses 3 different proxies for the possible net roles (authority, autonomous, and simulated). In the case of dispossession, the actor switches roles from autonomous to simulated. The client should no longer be producing NP InputCmd states for the pawn.
This issue only occurs for client-controlled pawns.
This can be reproduced in any scenario by possessing an NP-simulated pawn, holding some kind of continuous input down, and telling the controller to un-possess the pawn.
There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-147892 in the post.