Legitimate interest exists, and we use it at work. But because I work in the field of security, and for the sake of our infrastucture, we log specific informations and might drop a mandatory cookie at a time.

Everything outside that field cannot, I guess, be considered as legitimate interest.