Two machines from the same provider, same image, same week. One kept time to within a few milliseconds, the other wandered by most of a second over a day. The difference was that time synchronisation had quietly failed on the second one and nothing had complained.
timedatectl show -p NTPSynchronized --valueIf that prints no, everything built on top of it —
certificates, signed tokens, log correlation — is standing on sand.