Every user that accesses GS (project server) gets a CAL, even if they are not working on projects on the server. Support told me, that a CAL is taken if a suser has some server based projects in his list. It should be possible to:
a) see which user is connected
b) force logout those you know are not actually working on any project on the server, in order to free some CALs.