There's a discussion on the Obsidian Portal forum which asks the question, Should random encounters be level appropriate?
Many referees will tell you that part of what makes a sandbox a sandbox is that, in the words of the 3.5 D&D DMG, the player characters are forced "to adapt to [an] encounter rather than the other way around." Hazards in the sandbox reflect the verisimilitude of the game-world, not the relative power and abilities of the adventurers. Blackmoor's Temple of the Frog, with its hordes of guards and killer frogs, is a good example of the kind of hazard which may be found in a sandbox.
In a sandbox, player discretion is at a premium, because there is no guarantee that any given encounter or event won't have the potential to overwhelm their characters. Savvy adventurers use all of the means at their disposal to gather information on the game-world in order to prepare for, or avoid, hazards which are beyond their abilities.
The idea that encounters should be tailored to the abilities and skills of the player characters, on the other hand, has deep roots in the hobby as well. The random encounter tables of Appendix C of the 1e AD&D DMG, for example, suggest that the "[n]umber of creatures encountered should be appropriate to the strength of the encountering party."
In practice, most sandbox referees give a nod to verisimilitude while setting out the threats and challenges of their game-worlds. One common approach is to contrast settled, civilised - to some degree or other - regions with areas of howling wilderness. The adventurers may begin in the relatively benign civilized regions, or on a borderland shading into the wilderlands beyond, where threats are less likely to overwhelm well-played novice adventurers. It's not until the adventurers cross this frontier that the relative power level of the dangers of the setting begins to escalate significantly. This helps prevent snapping the players' suspenders of disbelief with respect to the game-world; a small village of simple tillers and crafters may be threatened by bandits or pirates or giant rats, but they are unlikely to have a mother dragon and her brood or a coven of werewolf-witches living next door, or a small planetary colony may be threatened by the indigenous xenofauna but not an alien battlefleet of megadreadnaughts, without some careful justification in the context of the setting. It also gives the beginning player characters a little breathing space to develop; the greatest dangers in the setting are mere rumors, or unknown altogether and waiting to be discovered, while the nascent adventurers sharpen their skills and their wits against more common.
Because encounters in most sandboxes are created with an eye to setting context rather than tailored to the adventurers, the referee provides intelligence to the player characters, in the form of rumors and legends or library data, about the relative hazards, so that the players may make at least somewhat informed choices about what sort of dangers their characters may face as they travel about the game-world. Beginning adventurers may choose to spend their time initially checking out the rumor of goblins threatening Happy Valley rather than the legend of the lich-kraken in its seafloor lair at the bottom of the Swirling Vortex of Watery Doom.
By the placement of hazards in the game-world along a gradient between least dangerous and most dangerous, the referee shifts the burden of taking on challenges "appropriate to the strength" of the adventurers to the players. To create this gradient, the referee should have a decent grasp of just how dangerous a potential opponent can be. Most roleplaying games spell this out in some way; a few border on the fetishistic.
So what about settings where the greatest threats in the game-world are only loosely organized around geography, where the differences between civilisation and wilderness are less stark?
Aside from an active battlefield, Paris is arguably the most dangerous place to be in Le Ballet de l'Acier, my Flashing Blades campaign. The highest concentration of excellent swordsmen in France - the King's Musketeers, the Cardinal's Guards, the most reknowned fencing masters, the most notorious duelists - is situated there, for example. Yet Paris is also a natural starting point for new player characters in the campaign - indeed, for some player characters, such as those who begin the game as Musketeers, life in Paris is required. Paris is by no means the only dangerous city in Le Ballet, of course - Marseille or Rouen or Dijon may have fewer notable swordsmen, fewer bravos, and so on, but they are present in each.
Cities in roleplaying games often feature a mix of threats in close proximity to one another - consider the range of relative power and ability found among the denizens of the City-State of the Invincible Overlord, Waterdeep, or Ptolus. The urban environment may be very different from the countryside, without a gradient between civilised and wild or partitioning of hazards approximated by distance from the ingress of a classic dungeon. In my campaign, set in the more-or-less-real world of 1625, the countryside isn't significantly different from cities. Aside from natural hazards like fording a river or a storm at sea, the only 'monsters' of note are ravenous wolves, angry bulls and such - most of the threats come from people as well, with murderous bravos in a Parisian alley becoming larcenous highwaymen on Bourbonnais forest road.
Another feature of cities is a number of the more dangerous threats in the setting may be readily accessible to the adventurers. It's possible to walk straight up to Gil de Berault, the feared swordsman known as "The Black Death," at Zaton's club in my Paris - more importantly, it may earn an adventurer with the temerity to do so without warning or introduction a handspan of steel through the heart. With respect to the adventurers adapting to the challenges of the game-world, rather than the other way 'round, this is A Good Thing.
So, with respect to proximity, partitioning, and accessiblity of threats and hazards, much of my game-world shares attributes similar to those of large cities found in other traditional roleplaying game settings.
But if, in the interests of verisimilitude and offering the kind of environment associated with sandboxes, I also want some number of dangers and situations to be appropriate to the adventurers' relative strength, then I must figure out a way to partition encounters to achieve an effect similar to the gradient between civilisation and wildlands in more traditional settings.
In my earlier musings on creating a swashbucklers' sandbox, I compared the relationships between non-player characters in the game-world to the rooms of a dungeon, complete with connecting corridors, secret passages, and chutes to catch the unwary. Part of the enduring appeal of dungeons is the ease with which hazards can be partitioned - at its most basic, the dungeon contains threats appropriate to first-level characters on the first level, second-level characters on the second, and so on. The dungeon environment provides the opportunity for the adventurers to seek their own challenges and to decide - to some extent - to punch above or below their own weight.
In my campaign, immediate relationships are the rooms - antechambers - closest to the adventurers. Some of these relationships come from Flashing Blades' character generation, such as Advantages and Secrets like Contact, Secret Loyalty, or Favor, while others are associated with with the player characters' careers, such as the officers and men in a Soldier's company and regiment or the professors and classmates of a Gentleman student of divinity. However, these relationships are typically not defined by degree of relative combat or skill prowess, as with levels and hit dice, Challenge Rating, and so forth, but rather by FB Social Rank. Social Rank is a rough indicator of soft power - access and influence - in the game-world, but there's a weak correlation at best to the potential for personal mayhem a non-player character can inflict.
The situation becomes more complex as a direct result of how I referee. As noted, geographical distinctions mean little in the game-world, perhaps even less than in many traditional city settings, and random encounters in my campaign frequently feature named non-player characters - like tripping a teleportation trap, an adventurer can find himself face-to-face with a dangerous duelist with little warning. Moreover, as referee I keep a very light hand on the controls, so unexpected twists reach across both sides of the screen.
For all intents and purposes then, "level appropriate" encounters tailored to the player characters are exceedingly rare in Le Ballet, particularly for novice adventurers who haven't earned an actual play-inspired reputation in the game-world. The burden to adapt to encounters in the game-world rests squarely on the shoulders of the players.