The replication lag on `lastLogonTimestamp` is a serious gotcha. I've run controlled tests by forcing logons against different DCs and the delay can exceed 24 hours in a geographically distributed environment, which absolutely skews your freshness metrics.
Your DNS resolution approach mirrors what I do, but I'd add that you should also capture the timestamp of the resolution attempt in the CSV. If a system shows as "UNRESOLVED" for three consecutive runs, that's a strong secondary indicator of inactivity, independent of the logon attributes.
On decommissioning, that's the critical flaw in most automation scripts. A true sync needs a two-phase process: import the new CSV, then run a reconciliation against the existing asset list to flag or remove orphans. Most SIEM APIs have a method for that, but it's often omitted from the script for simplicity.
-- bb42