It is very common for 404 responses to contain content in the body. The first example would be when you go to web sites, you get a helpful HTML page that has links to go back or go to the front page.
There is no reason why an API call shouldn't return a response body. In fact, it's something that the JSON:API specification encourages. The main reason is that it simplifies the error handling code on the client side if your server always returns content.
On the other hand, if you are not using the JSON:API standard, then you can make your own informed decision on the matter. The HTTP Status code does provide sufficient information for the client to know the resource does not exist. The only downside is that error handling in the client may be slightly more complex.
The only return HTTP status codes I am aware of that explicitly say should not have content include your 3XX codes for redirects and the 204 No Content code.
As Eric Lippert cautions, if you return a body, make sure that the error message you provide does not share information that the user is not authorized to know. A 404 indicates that there is no resource by that URL.
I work with systems where every call to the core APIs are authenticated, so I know who is making the call, and I am assured of what permissions they have. That said, I do prefer to have a body that includes a generic error message saying the resource they were looking for could not be found.