What information possibly sensitive information is included in apk files?
The obvious metadata are of course the fields in the signing certificate. But what about (absolute) file paths, user names used on the machine where the apk was built and similar information?
APK files usually don't contain much of that data unless the developer explicitly has added them or used unusual third party programs to edit resources contained in the app e.g. images. You can simply check that by unzipping an APK file ready to be released. Use full text search tools on all unzipped files and search for data you consider sensitive.
If you want to minimize unnecessary data I would recommend to use a virtual machine with e.g. a minimal Linux installation you where the installation itself does not contain any sensitive data. As Android apps can be built easily using Gradle on command-line you don't even need a UI. Use it to build the final APK file and copy it to the host OS. Examine the created file as described at the beginning and if you don't find anything it is ready for release.
tar stores usernames when you untar as a regular user, and the ownership is set to your own username anyway. Similarly, I wonder if apk may have some metadata that one may not expect. I guess using a virtual machine is the best solution to be absolutely sure, but still, it is interesting what metadata may be present in apk files.