Maintaining PreOwned Linux VMs

I have received several Linux VMs that I am moving into our own infrastructure. These machines were managed and maintained by several 3rd parties, and packages were installed I cant account for. What steps do I start to account for security and check for if these machines were compromised or insecurely configured. I have configured them to be on the internet and viewable, but they need to be audited, as anything could be installed, running or compromised. It's also not possible to reinstall them all at this point.