The 'wsToken' field in session data was once used by pre-AuthManager session handling, but it's not used anymore. The code was mostly removed in 2016 in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/267737/3/includes/user/User.php, with some more pieces removed in 2022 in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/861504. The only remaining references are the code that sets it, and some code in CentralAuth that tries to unset it. We should remove it.
(This field is not related to 'wsTokenSecrets', which is still used for CSRF tokens. We also set 'wsUserID' and 'wsUserName' in the same code, and those could probably be removed with some effort, but there are still some references in extensions.)