I wouldn't spend any money for some dubious rights in some software that was hacked together from various sources.
Actually, you don't need to spend money on it in first place. But you calling it dubious is for a somewhat obvious purpose, right? Well, anyhow, I checked the source, and yes, indeed, there is some third party code in it, apparently a collection of various contributions around P96. I find a couple of plugins for AdPro and Photogenics that are not authored by Tobias and Alex, and that should certainly be removed in the final distribution. I also find a couple of internal rtg test functions that seem to have been contributed from third parties and carry an outside copyright. They have not been part of the distribution, anyhow. I also see a Shapeshifter plugin that, as it seems, is not by Tobias and Alex, and I agree that such components should be either removed, or the corresponding authors should be contacted and negotiated with. I also see a re-implementation of the cgfx-api, that is a re-implementation of the open API of CGfx as it is documented and as it was available. Actually, as a separate library. So if that infringes third party rights, P96 would also work without it. That is certainly something that can be checked. I see no indication in the actual core for such "dubious" sources. Of course, that's not a proof that no third party rights are involved, but it seems to be rather non-obvious to proof or disprove such claims; calling it dubious is rather premature. That of course goes for every non-trivial software. In either case, I wonder how you can backup your position.