The postrotate script in src/logrotate.conf uses the which and find utilities
to do its work. Although logrotate itself is only a Recommends, I think which
and find are so ubiquitous that it makes sense to have them as hard
dependencies.
Also, I checked and the package names which and findutils are the same on all
the RPM distros we are currently targeting in the spec file.
In Debian, find is also in a package called findutils while the package
containing 'which' is called debianutils.