A Fernet token has the following format:
Version ‖ Timestamp ‖ IV ‖ Ciphertext ‖ HMAC
As the above shows, the timestamp is not part of the ciphertext, so anyone can read the time the token was made. In a live stream of data this may not be a problem, but for token stored on disk, an attacker may be able to use the creation time to assist cracking. Should the timestamp be encrypted?
Knowing the timestamp would help an attacker only if it affects any of the other token parts. If your IV is dependent on the timestamp, then you've failed already. Getting the entropy of the IV from something that is not dependent of the time it was created is the best way to solve this.
On a higher level knowing the creation time of a token could help the attacker choose the token he wants. Say the attacker knows with some accuracy the time of creation of the token he wants, then he can rule out the ones that are not interesting just by looking at the timestamp. If the IV and the encryption used is strong then this advantage is negligible.
