Welcome to the Q&A Forum

Honestly, Google is pretty smart about these spam links. They see hacked sites all the time, and chances are good that those spam links are not related to the content you're actually building the site around. That means the real risk is likely very low. That's especially true if the spam pages on your site created by the hacking are now 404ing. It's clear you're not trying to manipulate rankings. You can feel free to add spam links to the disavow pre-emptively. https://searchenginewatch.com/sew/news/2309486/matt-cutts-use-the-link-disavow-tool-even-if-your-site-hasnt-been-penalized Just make sure you only blacklist a site if the entire site is pure spam. Otherwise use the page disavow feature. I'd say you may as well do this, but it wouldn't be my top priority. The exception to this is if you were hacked and the spam links are relevant. Example: If the hacker created doorway pages about viagra, and your site is about sports memorabilia, I'd not be too concerned. Just make sure all the pages about viagra are dead. You can still submit a disavow. I probably would just to be on the safe side, but only once I got around to it. If the hacker created doorway pages about sports jerseys, and your site is about sports memorabilia, I'd be concerned. This could look like an attempt to manipulate Google's rankings, so I'd step on the disavow. And again, make sure any pages created by the spammers are 404ing or 410ing (even better).