Glitches in I/O signals & PLL implementation

The state machine outputs are decoded by combinational logic from present state. That's a standard Moore FSM scheme, but to get glitch free outputs, they have to be registered.

P.S.: I see, that you are also processing other signals (Mealy scheme) and have latches in the code. But glitches can be generated even by the basic decoder, so registering the outputs would be better anyway.