I've a general question around running fleet. We use a self-signed certificate to run Fleet container. Is that key material that's stored on the container used to help generate enrol secrets?

Enroll secrets are randomized and their creation shouldn't be affected by having a self-signed certificate. Just make sure that you include that certificate when you deploy osquery to the host.