Guide to protect SQL Server against speculative execution side-channel vulnerabilities
Untrusted application logic means any application or service running any logic that you(r organization) does not trust.

For your purpose, if you want to be lenient (potentially less secure) you can substitute "unauthorized" for "untrusted" - if the server is running any unauthorized code, it falls under that category.

If you want to be conservative (potentially more secure), assume all your servers run untrusted application logic and move on with that as a founding security assumption, applying the more secure recommendations to them.