To make this change, I assume the process would be to turn off all VMs, set cluster cpu type to broadwell, then turn on VMs to get the new CPU flags? Exactly, you can only reliably change the CPU type for a cluster once

Hi Roy the last Westmere-based host is gone. That's what I had to do when I when we upgraded CPU microcode on clusters to enable the various CPU mitigations within the guests. After changing the CPU type at the cluster level, you should see an orange triangle shown with each VM in the Web UI indicating what VM needs a restart in order to pick up the change. Because of those various updates to CPU microcodes, check your current BIOS/UEFI (though microcode is part of CentOS/RHEL) then check the CPU Type in the tab of each Broadwell-based host. As of writing, ideally set "Intel Broadwell IBRS SSBD MDS" (or the -noTSX) variant. Regards Mathieu