$ git grep sudo src/conf_mode/
src/conf_mode/load-balancing_wan.py:        cmd(f'sudo systemctl stop {service}')
src/conf_mode/load-balancing_wan.py:        cmd(f'sudo systemctl restart {service}')

Configuration mode scripts are executed under the context of vyos-configd/vyos-commitd and thus do not need an explicit call to sudo.
Permission handling is done outside via vyos-configd/vyos-commitd