In our docs for v4.16 in the sections below pages
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/postinstallation_configuration/configuring-multi-architecture-compute-machines-on-an-openshift-cluster#creating-multi-arch-compute-nodes-aws
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/postinstallation_configuration/post-install-node-tasks

found that the MachineSet Definition example is referring SecurityGroup Tags only set <infrastructure_id>-node or only ${Cluster-ID}-${node-role}-sg.

Since v4.16 this is changed and now the installer creates 2 SecurityGroups like below:${Cluster-ID}-node and ${Cluster-ID}-lb.

This will result in an error when we delete LB, some rules will leak. such as bug https://issues.redhat.com/browse/OCPBUGS-54623

v4.16    

Always

    1. Create a new Machine Set following the v4.16 documentation 
    2. Create a NLB
    3. Delete the created NLB
    4. Check the rules description like kubernetes.io/rule/nlb/

These rules can't be deleted

securityGroups should set like: 
          securityGroups:
          - filters:
            - name: tag:Name
              values:
              - <infrastructure_id>-node
          - filters:
            - name: tag:Name
              values:
              - <infrastructure_id>-lb    

similar bug before https://issues.redhat.com/browse/OCPBUGS-37110