My CPU wasn't getting the latest microcode by default, using latest rolling release. I remedied this by building my own iso via:
git clone -b current --single-branch https://github.com/vyos/vyos-build
cd vyos-build
docker run --rm -it --privileged -v $(pwd):/vyos -w /vyos vyos/vyos-build:current bash
sudo ./build-vyos-image --architecture amd64 --custom-apt-entry "deb http://deb.debian.org/debian bookworm main non-free non-free-firmware" --custom-package 'intel-microcode' iso
I confirmed this provides me with the latest microcode and works for me.

This has been requested since at least 2020 (https://forum.vyos.io/t/add-intel-microcode-to-included-packages/6223).

While we're at it, presumably we should also add amd64-microcode (https://packages.debian.org/bookworm/amd64-microcode).

Sorry if I'm naively reporting this wrong or anything, I just started using VyOS a few days ago and am not totally familiar with procedure/protocols for PRs etc. Happy to test, provide logs, implement the PR, etc (whatever is needed) myself. Thanks!