Best way I've managed to get penalty lifted is to first create a spreadsheet with all of your back links. Go through the entire lot that are suspect, contact all site owners first and ask to get the link removed. If no one replies then add that url to a new spreadsheet called 'disavow'
After 30 days, upload your disavow sheet to get these links removed.
Then when you submit to google to get your manual action reviewed / removed write down all the steps you done, share a link to google drive showing all the links you have found all the ones you marked as spam, and then in another column what action you took (contact / removed) provide evidence / the type of emails you submitted to site owners asking for replies one you get no response from provide screen shots of who is to show contact was hard or impossible to find before you took to disavowing. Also include a link to google drive with your disavow file.
You need to show them you have done the work, you care and you want the problem resolved.
This has been the only method I have found to get a penalty lifted in a timely manner.