We upload source maps to Sentry and would like to understand whether they may contain PII and if any precautions are required.

Source maps are not considered Personally Identifying Information (PII), but PII may be contained in them if it was present in your source code. This may include @author tags or GitHub usernames among other metadata.
​
If this is a concern, please take steps to avoid the inclusion of PII in your source maps. For example, you may consider normalizing paths at build time (e.g. output.devtoolModuleFilenameTemplate in webpack, sourcemapPathTransform in Rollup/Vite, --source-root in esbuild), stripping prefixes during upload with sentry-cli, omitting sourcesContent if you accept losing inline source in the issue view, and whether your build leaks absolute paths, since these can carry developer identities or real data in fixtures.