If a node has docker installed and a Rancher provisioned RKE2 install did not progress past the rancher-system-agent install, the log collector script will still detect RKE1 as the distro. This technically is not a big deal because if rke2 hasn't fully installed yet, there won't be any logs to collect. But the resulting structure of the log bundle will make you think it's from an RKE1 cluster. This happened in a support case I encountered today.
Maybe this should also look for rancher-system-agent?
https://github.com/rancherlabs/support-tools/blob/master/collection/rancher/v2.x/logs-collector/rancher2_logs_collector.sh#L102