OK, it seems I did jump to the wrong conclusion. 64 does not seem to be a limit, a user who is having this issue had that many items in his token cache. Because items appeared after removing group membership and because 64 is a multiple of 2, I assumed it was a limit of a hashing function.

Something strange is going on here.... the problem seems to be limited to a couple of machines and so it is probably a bug with them. I'll keep on looking into it.