Regulatory limits
The deviations depend upon the radio frequency licensing agreement applicable to each satellite. This is a feature of the International Telecommunications Union, ITU.
Limits in terms of degrees can be typically +- 0.05deg in both longitude and latitude or, especially for some older registrations possibly +-0.1 deg longitude and unlimited in latitude.
In terms of km this becomes
+-0.05 deg = +-37km
+-0.1 deg = +-74km
Inclined orbits
That said, operating a satellite with a latitude other than 0.0 deg largely means in an inclined orbit, and this means that the North-South excusions are equal and opposite over a 24 hour cycle. To do so also introduces an East-West excusion naturally (this follows geometrically). From the Earth looking up at a satellite with a slight inclined orbit at geosynchronous altitude the satellites motion appears circular for very small inclinations less than half a degree or so but becomes the "figure of 8" motion for larger inclinations.
Eccentricity
The eccentricity of the orbit will affect firstly the orbital height and then as a consequence its velocity at apogee and perigee and thus its longitude and also the shape of the figure-of-8.
An example eccentricity is 0.0003, which would lead to a ~12km excursion in height from the Geostationary radius.
Natural perturbations
A non manouvering object left exactly at GEO will drift firstly in longitude because the Earth is not exactly spherical. Correcting this is called East-West Station-keeping and is usually done every couple of weeks, depending on the type of propulsion system, and this is roughly sufficient for the +-0.05 deg limit.
The effects of gravity of the Sun and the Moon, "luni-solar" perturbations, cause the satellite's inclination to change. It also causes the Right Ascension of the Ascending Node, RAAN, to change though we can come back to that. If left uncorrected this will cause a North South drift of roughly 1 deg in the first year. North South Station Keeping, NSSK, is also often performed once every week or two but is far more costly in energetic terms and has driven the development of more efficient propulsion to keep propellent requirements down.
Many satellites are actually operated without NSSK towards the end of their working lives to save propellant though this depends on the ground users still being able to obtain a good signal from the displaced satellite. Interestingly, objects left to drift indefinitely reach a maximum inclination of ~15deg before their inclination drifts down again over several decades.
The physical size of the satellite, its Area/Mass ratio and reflective properties, also make the satellite subject to Solar Radiation Pressure. This can cause the eccentricity to grow, which increases the daily East-West drift, and thus reduces the time before an East West manouevre is needed. Hence Eccentricity correction, reducing the eccentricity and making the orbit more circular is usually performed at the same time as the East-West manoeuvres themselves.
Collision avoidance
There are also international guidelines for debris mitigation which suggest that the operational zone for GEO in height terms is 42164.5 +- 50km and that the rest of the way up to +-200km is a "manoeuvre corridor" for satellites undergoing a change of station. This isn't mandatory but is, I believe, followed by a large fraction of operators.
Footnotes (EDIT responding to comments)
By "largely means in an inclined orbit" I am only referring to the possibility, not necessarily practical, of operating with some continual thrust or solar radiation pressure so as to achieve a non-keplerian orbit. I'm not aware of any satellite that does this, though proposals for a "Statite" could be in this territory.
By "not exactly spherical" I am referring to the tri-axial shape of the Earth rather than its oblateness. The former refers to the land mass features we call continents and the latter relates to slight flattening at the poles. Tri-axiality causes accelerations in longitude East or West according to the longitude relative to two stable longitudes. There are two corresponding unstable longitudes also. The acceleration and thus East-West Station Keeping burden is least at these four points.
