What actually resides with in K2 DB, is there any sensitive data ?

"Sensitive data" is a very subjective term, can you be more specific?

If you're using InfoPath or SmartBoxes then all the data from those objects would be stored there.  There is also user data, like PII being pulled from Active Directory.