CVO123 IIS rewrite rule mitigations that were applied on a per-site/vDir level (stored in web.config files) are not retained. Server level mitigations (stored in applicationHost.config) will not be overwritten.
However, if an IIS rewrite rule mitigation has been overwritten during a CU installation, it'll be automatically reapplied by the Exchange Mitigation (EM) Service as long as the mitigation is still required/valid for the newly installed CU.
We've clarified this in the documentation: https://learn.microsoft.com/en-us/exchange/plan-and-deploy/custom-configuration-preservation?view=exchserver-2019#list-of-preserved-config-files-along-with-sections-and-keys-preserved