As I said, there may still be a file referencing it, which you have found:
(BTW, should avoid using sudo when not required, like here. See this discussion if you’re interested in the details.)
See what happens when you disable that sources file:
sudo mv /etc/apt/sources.list.d/veeam.list{,.disabled}
Then run sudo apt update; see if there is still a line for the veeam repository. If there isn’t, we need to take a closer look at all the sources.list files:
grep -r '' /etc/apt/sources.list*
On a more OpSec related note, while searching for installation instructions, to take a look at the sources.list creation procedure, I found this:
It’s probably not a good idea to do so blindly, because that undermines the very idea of Secure APT, and the PGP/GPG Web of Trust idea at its core, for that matter. One should always authenticate such keys first. That can be as easy as comparing the fingerprint against a public record of it, i.e. on the vendor’s TLS-signed and encrypted website, to be sure no Man-in-the-Middle attacker can do a switcheroo of said key, or the .deb package it is delivered in. Ideally such keys should be signed by some trusted 3rd party; IIRC, the signing keys of the Tor Project’s repository are signed by some Debian developers in debian-keyring. Explaining all that is out of scope here; feel free to open a new topic if you’re interested. Or just have a look at this:
https://wiki.debian.org/SecureApt#How_to_tell_if_the_key_is_safe