Warning: This answer is not intended to cover all possible scenarios, as the use of oyster and contactless within the "Greater London & Friends" zone is pretty nuanced, warranting an entire website explaining how it works and when does it not work.

Summary: In general, one should only touch in at the start, and touch out at the end of their oyster/contactless journey, unless they have to change trains, which usually involve one of the following per train change:

1. Walking up to the next train (i.e. doing nothing with your card), or
2. Touching a pink route validator once, or
3. Doing an Out-of-Station Interchange (OSI) - touching out on a yellow reader in a location, and back in on another yellow reader in another location (they should come in pairs).

Exceptions apply, mainly on route that involving changing from/to trams.

The Basics

TfL stated on their website on when to touch in or out:

Tube, DLR, London Overground, TfL Rail, National Rail, River Bus and Emirates Air Line

Touch in on a yellow card reader at the start of your journey and touch out at the end.

To pay the right fare: [...]

• Always touch out even if the gates are open. If there are no gates, use a freestanding yellow card reader next to entrances, exits or on platforms

Changing trains

One might need to touch their oyster in between their journey more than once. It could be on a pink oyster reader when one intends to avoid zone 1 in their journey, or a pair of yellow readers when they are doing an OSI.

Quoting Mike Whitaker, who explains what OSIs are on his website:

Out of Station Interchanges

At most London terminal stations you have to go through gates between the National Rail platforms and the concourse, while the Underground station is through a further set of gates in its own ticket hall. Sometimes you have to go out onto the street to walk between stations (eg Shadwell, Shepherd’s Bush) and sometimes two nearby stations are deemed close enough to allow interchange between them (eg New Cross and New Cross Gate). In each of these instances the Oyster system allows you to join two journeys together as long as you don’t take too long between touching out at one station and in at the other. This is known as an Out of Station Interchange, or OSI for short.

In a comment Mike also confirmed that one can chain OSIs, that is to touch out at the Underground part of station A, back in at the Overground part of station A, back out at the Overground part of station B, and back in again at the Underground part of station B, and so on.

This webpage contains the list of stations where OSIs are permitted as of Feb 2019. One can see Finsbury Park, Lewisham, Tottenham Hale, and Walthamstow Central are all in the list.

Hence if one is changing between National Rail / Underground (or in the case of Lewisham, DLR), they should always touch out at one transport mode, and back in for another to ensure their fare is calculated correctly. It doesn't matter if they are gateline validators or standalone validators.

Cheshunt is an interesting example from the OP, as it is not on the OSI list, though it is likely an oversight (there are some other stations with an OSI between a station and itself is permitted "where accessible routes require leaving and re-entering the paid area.", and require some petitions to correct.

The standalone validator confusion

The standalone validators found in e.g. Finsbury Park

were intended to start or end Oyster journeys without leaving the station because the overall journey continued using paper tickets on National Rail.

-- Mike Whitaker (on Continuation Exits)

So if you are starting/ending your Oyster/contactless journey at that station, by all means use the standalone reader to touch in/out. Otherwise, and if you are not using them as part of an OSI, in most cases you should steer clear from them.

While there is a mechanism called Continuation Exits that protects most customers from accidentally being charged more by touching those readers when they are not meant to, unintended consequences do occur.

More exceptions - interfacing with trams

Again, more exceptions apply if you are in Wimbledon, Mitcham Junction, and Elmers End, and your journey involve trams. In this case please refer to the official advice from TfL.

What if I forgot to touch some of the readers?

... or what if I touch more readers than I needed to?

The fare calculation might get confused. It might figure out the route one actually took and charge them the right fare. It might also treat their journey as multiple incomplete journeys and slap them with multiple maximum fare. In such cases, one can only contact TfL and get it sorted out.

Yellow readers are usually used for people starting and finishing a journey, And pink readers are there to help with charging correct fares.

This link

https://tfl.gov.uk/fares/how-to-pay-and-where-to-buy-tickets-and-oyster/pay-as-you-go/touch-pink-card-reader-when-changing-trains

Explains it a little better.

Yellow standalone readers are often found at intermodal stations. Ie. Changing from Rail to Tube, where platforms are shared or within the same gated area, and where you may have traveled on a normal rail or season ticket on train, and are then changing to the tube and using oyster or contactless payment. Stations like Finsbury Park and Farringdon are two I’ve experienced with yellow readers as they are interchange stations

You will also find yellow ones at all dlr stations which are ungated

So as a basic rule of thumb if you are starting and finishing a journey then yellow, with pink if you are transfering on a journey with different route/zone options