From this microsoft document: word format / google word->html it's used for security purposes.
Excerpts from the "Security Improvements section" :
The cluster service no longer runs under the context of a domain user account, also known as the Cluster Service Account (CSA). Instead, the failover cluster service runs under the local administrator account with the same privileges as CSA. This account relies heavily on the Cluster Name Object (CNO) in Active Directory.
Legacy NT LAN Manager (NTLM) is no longer required, and instead Kerberos will be the primary authentication. All network name resources will have Kerberos enabled and a computer object created, such as CNO or Virtual Computer Object (VCO). In addition, now all communications between nodes are secure; encrypted inter-node communication is configurable, and off by default. The CNO corresponds to the cluster name and is created in Active Directory when the cluster is created. Since a domain user account is no longer used for the cluster service, the CNO is used for all operations that require security inside the cluster. For example, when a network name is created and the resource is brought online, the CNO is used to create the VCO for that Network Name resource in Active Directory.