I'm not OP, but I choose the first two. What are your recommendations?
It depends on your goal.
Me; <=2014 CPU, DDR3, Whonix/Gentoo OS with eBPF JIT compiled out for servers;
QubesOS for desktops with bleeding edge CPU, H/T BIOS disabled, and CPU IBT compiled out.
Absolutely no JavaScript (not even WASM).