Users have access to records they should not see based on system Sharing Rules.
The records visible to the User do not qualify for current Sharing Rules.
Access & Permissions
Navigate to Setup. In the Quick Find box, search Sharing Settings. Select the Edit button. Scroll until you see the object you're looking for (Prospect, Appointment, Sale, etc), and select Private from the dropdown box.
Global system Sharing Setting for the Object was set to "Public Read/Write" which overrides the system's Sharing Rules.