Does a synthetic CNH still count as sensitive personal data?
Not if it does not correspond to any real driver: without a link to an identifiable person, the generated number is not anyone's personal data; the sensitive-processing risk exists when the value is a real CNH, or when a synthetic one is mistakenly linked to a record that represents an actual person.
Why not use an employee's CNH as an example in internal documentation?
Because it spreads that person's number, and possibly their license category and associated history, across documents, screenshots and repositories in a way they almost certainly never authorized; a synthetic value fills the same example role without carrying anyone along with it.
Does generating the synthetic CNH locally avoid an unnecessary network call?
Yes, the entire calculation, drawing 9 digits and computing two modulo-11 check digits, runs in the browser; a generation endpoint would be an unnecessary network surface, and it would still leave a server record of every value issued.
Does a staging environment with a synthetic CNH still need access control?
Yes, the basic care that applies to any environment, access control, limited retention, still holds; what changes is that if this environment leaks, no real driver has their license number, category or history exposed alongside the rest of the test data.