RFID RC522 reads the previous tag serial with different tag
One rule for writing safety code is :

The return value of non-void functions must be checked by each calling function, and the validity of parameters must be checked inside each function.

You forgot to check if the tag has been readed i.e the return value of PICC_ReadCardSerial. If it fails the value is not updated, that is the reason why the value is still the old one.

Using the following code (from the ReadNUID example of the MFRC522 library https://github.com/miguelbalboa/rfid/blob/master/examples/ReadNUID/ReadNUID.ino)

// Init array that will store new NUID 
byte nuidPICC[4];

void loop() {

  // Look for new cards
  if ( ! rfid.PICC_IsNewCardPresent())
    return;

  // Verify if the NUID has been readed
  if ( ! rfid.PICC_ReadCardSerial())
    Serial.println(F("NUID has NOT been readed."));

  if (rfid.uid.uidByte[0] != nuidPICC[0] || 
    rfid.uid.uidByte[1] != nuidPICC[1] || 
    rfid.uid.uidByte[2] != nuidPICC[2] || 
    rfid.uid.uidByte[3] != nuidPICC[3] ) {
    Serial.println(F("A new card has been detected."));

    // Store NUID into nuidPICC array
    for (byte i = 0; i &lt; 4; i++) {
      nuidPICC[i] = rfid.uid.uidByte[i];
    }

    Serial.println(F("The NUID tag is:"));
    printHex(rfid.uid.uidByte, rfid.uid.size);
    Serial.println();
  }
  else Serial.println(F("Card read previously."));

  // Halt PICC
  rfid.PICC_HaltA();

  // Stop encryption on PCD
  rfid.PCD_StopCrypto1();
}

void printHex(byte *buffer, byte bufferSize) {
      for (byte i = 0; i &lt; bufferSize; i++) {
        Serial.print(buffer[i] &lt; 0x10 ? " 0" : " ");
        Serial.print(buffer[i], HEX);
  }
}


the result is


  A new card has been detected.
  The NUID tag is:
  97 C6 6E 09
  NUID has NOT been readed.
  Card read previously.
  A new card has been detected.
  The NUID tag is:
  CC 16 5D 83
  A new card has been detected.
  The NUID tag is:
  97 C6 6E 09
  NUID has NOT been readed.
  Card read previously.
  A new card has been detected.
  The NUID tag is:
  CC 16 5D 83


Sometimes when the second tag is used the tag is not read and the uid remains the same.