Mainly cryptographic keys like the SSH host key, or stored RNG state. But this can very easily be mitigated using `cloud-init` or similar.