Hi @Kendall_Gjevre,
For your reference, I have written a guide to help out in identifying Legacy API Key connections.
You can cross reference the integrations in the guide to see if they are at risk. Although it is not 100% accurate given the fact many integrations were developed over the years, so some using the Legacy API Key will not be known about yet.
If your client have custom developed API scripts that were done several years ago, there is a chance they they are at risk of breaking.
Did you client get an email from Keap saying the number of API calls that were done in the previous 30 days?
If so how many were done? That will help to see if they are using it extensively or not.