The sysmediumconfig1 security guideline is tested for by checking that last_run_summary.yaml is less than 15 days old. It's failing for all spot instances, though. The guideline is basically verifying that puppet has run "reasonably recently" on the host, which is a perfectly valid expectation for spot AMIs, too -- they should have been generated "reasonably recently". It looks like this file goes missing when puppet is uninstalled. Just touching it when baking the AMI should be sufficient.
This will be replaced by whatever taskcluster is doing.