Hi,
CNRS2 and CNRS2-Standard are part of the CA chain that issued your HTTP and LDAP server certificates, they should not be removed.When you install a new embedded IPA CA, it doesn't replace the existing HTTP and LDAP server certificates with new ones issued by IPA CA. You will be able to remove CNRS2 and CNRS2-standard (IF you don't use any other cert issued by them) only when the HTTP and LDAP server certs are replaced with new ones issued by IPA CA (which is a manual operation).
flo