Files that can be excluded from backup
The key directories are modules, themes, and profiles. You also want to backup all settings.php files, and uploaded files as well. Although, I would separate the two into two backup files, since, depending on the site, the uploaded files directory could be in the low MBs or hundreds to even GB of files. Give them both a readable date timestamp for a filename.

Also, backup your composer.json and composer.lock files. If you control your site build using Drupal Project or Acquia BLT which has a composer driven approach, composer.json will contain the information needed to rebuild your site (this does not include data, only code). Then it's just a matter of backing up custom modules and custom themes, since composer can fetch all the code and rebuild core.