Could it be the tokens in the `bx_oauth_access_tokens` or maybe the `bx_oauth_refresh_tokens` - They both seem to have the same number of records.
