What is the requirement on images of expired card numbers? The images are over ten years old. If the data is old do I still need to encrypt the data?
PCI DSS doesn't discriminate between expired and active card numbers; it simply says that PAN (the Primary Account Number) being present is what triggers the need for protection:
The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected in accordance with applicable PCI DSS requirements.
You can ask your QSA for an official opinion, but lacking explicit guidance, I suspect most will agree.
An analogous situation would be synthetically generated card numbers (e.g. http://www.getcreditcardnumbers.com/, https://ccardgenerator.com/). No QSA I've ever dealt with recognized the legitimacy of such card numbers as test data; the card brands do not recognize them as test data. They are mod-10 legitimate PAN numbers, therefore, they could intersect with a live (issued, non-expired) PAN and are, as such, "real credit card numbers". The card number itself is the minimum required to make a charge, so PAN is PAN.
The flip side of the coin is - for whatever purpose are you keeping images of decade-old card numbers? If the data is so useless as to not require protection, what use are you putting it to? You may wish to re-architect your flow to remove the need for this data.
These are expired cards, and not valid. I can find no where in the DSS where it regulates the storage of non-valid Credit Card information. I would check with your PCI auditor, but I believe you are fine. I think it's worth saying that it's probably good practice to destroy these if not needed or required by some other standard like HIPPA. There is no requirement for data retention time specific to PCI, just an expectation of having policies in place to deal with this. See page 36, Requirement 3.1-3.1.b
If any of them are not expired (so better be sure), per the pci dss 3.2.1, you can not retain CC information with full PAN, it has to be encrypted or truncated. So again, I would destroy them if possible. If not, verify all are actually expired, and if you can't be sure they are expired then they need to be stored and transmitted encrypted.