It seems that recently, after reimaging a host, we get a notification for not-in-sudoers executed command for:

mw1330.eqiad.wmnet : Dec 19 12:16:50 : mwdeploy : user NOT in sudoers ; TTY=unknown ; PWD=/root ; USER=mwdeploy ; COMMAND=/usr/bin/rsync --archive --delete-delay --delay-updates --compress --delete --exclude=**/cache/l10n/*.cdb --exclude=*.swp --no-perms --exclude=**/.git tin.eqiad.wmnet::common /srv/mediawiki

That line is referenced in scap-master-sync and mw-deployment-vars.erb in our puppet. The scap-master-sync does also add a sudo rule to execute the script, so it might be it and that somehow the script, upon the first puppet run after a reimage, is run before the sudoers rule is installed.