generally Marketo deletes all anonymous leads that had no web activity in the past 90 days.
That's not the case. You're thinking of the Visit Web Page activities themselves, which is different from the lead — the lead being a single associated Munchkin cookie.
In fact, even though the documented intent of the retention process is to remove the Visit Web Page activities for both known and anonymous leads once they're > 90 days old, this doesn't happen consistently in practice. You'll see the variety by running the WPA report across a variety of instances. It can return anonymous leads whose last activity was > 90 days ago, and it's not just a frozen timestamp of last activity, you'll see the actual entries on the Activity Log tab.
The actual process of when Marketo stops tracking an anonymous session is complex. For example, naturally expired cookies (in all browsers) or forcibly expired cookies (in stricter browsers like Safari) will result in a new cookie being created when the person returns. Thus the same human, in the same browser profile — in addition to the same human across browsers and devices, which is also true — corresponds to multiple anonymous leads.