Worst slack values are Negative for Removal

That path is the open core plus logic. I have filled a bug against that already since it should constrain itself and since it operates on the slow JTAG clock you can safely ignore it. So if the only failing paths have names like this:

pzdyqx: nabboc|pzdyqx_impl: pzdyqx_impl_inst|FNUJ6967

you can ignore those. So the reason why you are seeing failures is that the logic isn't constrained and not necessarily true failing paths. Unfortunately those are randomized names so you can't add in your own constrains easily. If you were not expecting open core logic in your system then I would look at your licenses and compare against the IP you are using. When you don't have a valid license for an IP block that supports OCP you'll be able to use it in tethered mode (which uses that logic that is showing up in the failing path).