I’d remove those from your backups. There was a situation a while back where a guy has his Google account shut down because he sent pictures of his child’s skin rash to his doctor, and the photos were flagged as CSAM when he uploaded them.

Edit: A bit late, but here’s an article about it: https://www.theguardian.com/technology/2022/aug/22/google-csam-account-blocked