I have done some research and gotten bits and pieces of information from various places that I have tried to piece together to try and form an answer to this. Here goes:
In AD managed environments the DC acts as the login verification server. When a user logs in their credentials are verified against the SAM held on the DC (by way of Kerberos). There is still a version of the SAM held on the endpoint machine which contains user information, security policies for user groups and also cached user credentials - this credentials for users that have previously logged into the machine. There is a security policy which can be set to determine the number of cached credentials called "Interactive logon: Number of previous logons to cache" with the default being 10. Obviously the DC SAM will contain user information for all users on the domain and the endpoint SAM will only contain information for users that have logged into that particular endpoint.
The purpose of keeping this information in the SAM on the local endpoint is usually to do with network availability. It's purpose is to still allow a user to log into the endpoint if the DC is not available (eg you have a poor network connection) or network efficiency in a low bandwidth environment (an example might be that the endpoint only verifies with the DC SAM for one login a day while all other logins are done from the endpoint SAM to save on bandwidth).
So in essence the endpoint SAM acts as a redundancy for the SAM stored on the DC to allow for connectivity issues or low bandwidth environments. This seems to be a bit of a security issue, but I guess this is how Windows works.
This is probably the best single source of information. I only found it once I discovered the existence security policy setting for "Interactive logon: Number of previous logons to cache".
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available
