For production server kernel: The only kernel patches these days i'm aware of that aren't upstream are hardware drivers for very custom hardware, or ones we released but upstream didn't want and we still maintain.

Like any sane kernel team, google tries to minimize it's difference with upstream since it has huge maintenance cost.