Hi Kevin,
The secondaries in a replica set do lag behind the primary. Because the secondaries tail the OpLog there is always going to be some amount of lag caused by anything from network traffic to I/O contention. The replication lag might explain why you are still seeing inserts and deletes on the secondaries after the primary is finished.
You can check the state of the replication lag with "rs.status()" from the shell. You will see the opTime of the primary and the opTime of all the secondaries. The difference between these dates is the replication lag You can see more information including the size of the opLog with "db.printReplicationInfo()"
How long after shutting down reads and writes are you still seeing activity on the secondaries? How are you enforcing no more writes and reads?
On the second point regarding getLastErrror. This is not actually indicating that an error has occurred. By default a write operation with Mongo does not wait for a response, to get one you would issue a write and check for the last error with a call to getLastError. Often this is done in the drivers in what is known as 'safemode' writes. What I would suggest is happening is that the replication writes are using getLastError to determine that write were successful.
Hope this helps,
André