Is there redundancy in saying that something "can be a potential risk"?

what differentiates a "potential risk" from an actual one

Adding 'potential' could indicate Knightian uncertainty (ignorance, unknowability), in addition to or instead of quantifiable risk. In other words, a 'potential risk' is one that is still unknown (could be zero probability), whereas a 'normal' risk has a known probability strictly greater than zero.