Here is the script

From what I can tell you are correct this is probably a keystone token issue.
However, the credentials are generated fresh for each test iteration.
The only resources created and which may be dangling are the floating IPs.

#!/bin/bash -xve

export network_flavors="LSEC"

export DOMAIN_ID=$(openstack domain show admin_domain -c id -f value)
export OS_REGION_NAME=RegionOne
export OS_AUTH_URL="<removed>:5000/v3"
export OS_IDENTITY_API_VERSION=3

for try in {0..3}
do
  echo "Test iteration # $try"

  for network_flavor in $network_flavors
  do
     source ./novarc

     export WORKLOAD_PROJECT_NAME=project_${network_flavor}-bugtest
     export PROJECT_ADMIN_NAME=project_admin_${network_flavor}-bugtest
     export PROJECT_MEMBER_NAME=project_member_${network_flavor}-bugtest
     export EXTERNAL_NETWORK=${network_flavor}
     export VM_ID=vm_${network_flavor}-bugtest
     export INTERNAL_NETWORK=${EXTERNAL_NETWORK}-TENANT
     export INTERNAL_ROUTER=internal_router_${network_flavor}-bugtest
     export INTERNAL_SUBNET=internal_subnet_${network_flavor}-bugtest
     export KEY_PAIR=key_pair_${network_flavor}-bugtest

     ADMIN_ROLE_ID=$(openstack role show -c id -f value Admin)
     MEMBER_ROLE_ID=$(openstack role show -c id -f value Member)

     <email address hidden>
     SUBDOMAIN=${network_flavor}
     DOMAIN="<removed>"
     # Create a workloads project

     WORKLOAD_PROJECT_ID=$(openstack project create --enable --domain ${DOMAIN_ID} ${WORKLOAD_PROJECT_NAME} -c id -f value)

     # Create Project Admin in new domain

     PROJECT_ADMIN_ID=$(openstack user create --domain ${DOMAIN_ID} --password ${PROJECT_ADMIN_NAME} --enable ${PROJECT_ADMIN_NAME} -c id -f value)

     # Assign 'Admin' role to Project Admin in new project
     openstack role add --project ${WORKLOAD_PROJECT_ID} --user ${PROJECT_ADMIN_ID} ${ADMIN_ROLE_ID}

     echo "unset OS_DOMAIN_NAME" >novarc-${PROJECT_ADMIN_NAME}
     echo "unset OS_PROJECT_NAME" >>novarc-${PROJECT_ADMIN_NAME}
     echo "unset OS_PROJECT_DOMAIN_NAME" >>novarc-${PROJECT_ADMIN_NAME}
     echo "unset OS_TENANT_NAME" >>novarc-${PROJECT_ADMIN_NAME}
     echo "unset OS_USER_DOMAIN_NAME" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_DOMAIN_ID=${DOMAIN_ID}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_PROJECT_DOMAIN_ID=${DOMAIN_ID}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_USER_DOMAIN_ID=${DOMAIN_ID}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_PROJECT_NAME=${WORKLOAD_PROJECT_NAME}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_AUTH_URL=${OS_AUTH_URL}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_AUTH_TYPE=password" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_IDENTITY_API_VERSION=${OS_IDENTITY_API_VERSION}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_INTERFACE=public" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_REGION_NAME=${OS_REGION_NAME}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_USERNAME=${PROJECT_ADMIN_NAME}" >>novarc-${PROJECT_ADMIN_NAME}
     echo "export OS_PASSWORD=${PROJECT_ADMIN_NAME}" >>novarc-${PROJECT_ADMIN_NAME}

     # --------------------------------------------------------------------

     # Create Project Member in new domain

     PROJECT_MEMBER_ID=$(openstack user create --domain ${DOMAIN_ID} --password ${PROJECT_MEMBER_NAME} --enable ${PROJECT_MEMBER_NAME} -c id -f value)

     # Assign 'Member' role to Project Member in new project

     openstack role add --project ${WORKLOAD_PROJECT_ID} --user ${PROJECT_MEMBER_ID} ${MEMBER_ROLE_ID}

     echo "unset OS_DOMAIN_NAME" >novarc-${PROJECT_MEMBER_NAME}
     echo "unset OS_PROJECT_NAME" >>novarc-${PROJECT_MEMBER_NAME}
     echo "unset OS_PROJECT_DOMAIN_NAME" >>novarc-${PROJECT_MEMBER_NAME}
     echo "unset OS_TENANT_NAME" >>novarc-${PROJECT_MEMBER_NAME}
     echo "unset OS_USER_DOMAIN_NAME" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_DOMAIN_ID=${DOMAIN_ID}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_PROJECT_DOMAIN_ID=${DOMAIN_ID}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_USER_DOMAIN_ID=${DOMAIN_ID}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_PROJECT_NAME=${WORKLOAD_PROJECT_NAME}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_AUTH_URL=${OS_AUTH_URL}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_AUTH_TYPE=password" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_IDENTITY_API_VERSION=${OS_IDENTITY_API_VERSION}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_INTERFACE=public" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_REGION_NAME=${OS_REGION_NAME}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_USERNAME=${PROJECT_MEMBER_NAME}" >>novarc-${PROJECT_MEMBER_NAME}
     echo "export OS_PASSWORD=${PROJECT_MEMBER_NAME}" >>novarc-${PROJECT_MEMBER_NAME}

     openstack network rbac create --target-project ${WORKLOAD_PROJECT_ID} --target-project-domain ${DOMAIN_ID} --action access_as_external --type network ${EXTERNAL_NETWORK}
     openstack network rbac create --target-project ${WORKLOAD_PROJECT_ID} --target-project-domain ${DOMAIN_ID} --action access_as_shared --type network ${INTERNAL_NETWORK}

     for i in $(seq 1 5); do openstack floating ip create -vvv ${EXTERNAL_NETWORK}; done
  done

  # as cloud admin
  source novarc
  openstack user delete $PROJECT_ADMIN_ID
  openstack user delete $PROJECT_MEMBER_ID
  openstack project delete $WORKLOAD_PROJECT_ID
done