Specifically for the machine-id file, if systemd detects that the rootfs is read-only then it just creates a temporary machine id which, if I remember correctly, is bind mounted over top so that the base rootfs is unmodified.
There certainly may be other things inadvertently writing though. Please let us know what you find.
Drew