There are also a handful of games which put some additional purely cosmetic content behind an online check. That could be the start of a slippery slope, which people are justly upset about, but they then do an injustice to their cause by generalizing from those cases.
Note that for Gloomhaven, the multiplayer server is one of the players' computers. That player hosts a game and everyone else joins. There are no GOG servers and no company servers.
In version 1.0 of the GOG release, multiplayer is enabled.
In subsequent versions, multiplayer is disabled (in the sense that the button to host or join a game is greyed out) unless the game succeeds at verifying you through Galaxy. (And this is a dynamic status; you can have it enabled, shut off Galaxy, restart the game, and find that it's disabled again.
But apparently that isn't DRM.
Which ones? Honest question. I only remember games for which GOG apologizes in their store page for missing cosmetics or extra features because originally tied to online services (e.g. the Mafia or Yakuza games), or ones in which they are unlocked by default for the same reason (e.g. Dragon Age Origins).
https://www.gog.com/forum/general/drm_on_gog_list_of_singlep... has a full list.
It's not a slippery slope but already full blown DRM plain and simple. Both online functionality limited to GOG-run servers and checks for cosmetic content.