There probably is at least one instance that isn’t federated that’s dedicated to csam. These were uploaded to lemmy.world as an attack, and because of the way federation works some of the content is then downloaded onto the servers of other instances when it’s viewed or interacted with from a federated instance.