Inspect which document links and why. A reference useful to readers differs from a link bought or exchanged primarily to manipulate rankings.
Metrics such as Domain Authority are estimates produced by their providers, not scores assigned by Google. Check the link’s existence, relevance, accessibility and surrounding context.
Unsolicited spam links do not by themselves establish an automatic penalty. Google says most sites do not need its disavow tool. Inspect problematic links you created and any manual action before considering broad disavowal.