In each Wordpress website there is a Wordpress package in ../.wp-cli/cache/core .. about 24Mb in size as well.
Once Wordpress is installed, do we really need this package to be kept in each website file system?
We're looking at ways we might be able to install WordPress from a global cache directory rather than having wp-cli build a cache directory on each website.
In the meantime you can definitely remove that file.