A significant factor is that privacy addresses won't be released if there are active connections using that address. So if the machine is running something with

A significant factor is that privacy addresses won't be released if there are active connections using that address. So if the machine is running something with long lived connections; big downloads, push notifications, IM clients, ssh sessions and so on, then it can end up a growing stack of unreleased addresses. A typical admin who ssh's to a few boxes every so often, but then leaves those connections open in a tmux/screen/terminal-tab session can cause havoc.