When the Application menu doesn't have ITIL role and a module under it has ITIL role , the parent application and the modules under it with ITIL role are shown in the Nav bar for ITIL users even with "override application menu roles" unchecked for the modules with ITIL role.
If the Application menu doesn't have ITIL role, a module has ITIL role(or the roles that ITIL role contains) and a module that has ITIL contained role has "override application menu roles" checked, then the ITIL role users are able to see the modules with ITIL role as well as ITIL contained role.
In order to give access to the ITIL contained roles, ITIL role should first get access. So the application modules with ITIL role and the ITIL contained role are accessible from nav bar if one of the modules with ITIL contained role has "override application menu roles" checked
The resolution is to adjust the roles and the override application menu roles for the nested modules accordingly.