This usually isn’t just about spam links, especially if there’s no manual action showing in Search Console. Google is pretty good at ignoring bad links on its own.
What stands out more is the long gap of inactivity and then a big content change. When a site goes quiet for years, Google often drops trust. Adding a lot of new pages at once doesn’t instantly bring that trust back.
I’d focus on basics first: make sure pages are indexable, improve internal linking, update a few key pages properly (not everything at once), and give it time. I wouldn’t rush to disavow unless you see a manual action. Recovery from “visibility = zero” is usually slow, not instant.