The current examples in the monitoring.yml doc choose a deprecated CPE for systemd (cpe:2.3:a:freedesktop:systemd, in addition to the currently valid one) to include into the file.

"freedesktop is from freedesktop.org and is a good candidate, so we add it"
https://nvd.nist.gov/products/cpe/detail/91E4D01A-BEFA-447F-9449-E4C1CCA72319?namingFormat=2.3&orderBy=CPEURI&keyword=cpe%3A2.3%3Aa%3Afreedesktop&status=FINAL%2CDEPRECATED

This is probably not a huge issue but ideally we'd avoid including CPEs that have been deprecated.

Related: getsolus/packages#2511