Does it matter if you're running it in a VM just to play games? In any case, mydigitallife is a trustworthy source. They provide checksums and you can also check elsewhere to verify if you calculate the checksum. I've done this and every ISO I downloaded through MDL was identical to the original ISOs. They used to just link to the originals on Microsoft's servers, but MS removed access to them years ago. So, thanks for that, MS. Moloch strikes again, I guess.

What a coincidence: I was literally doing this today.

I used this:

https://archive.org/details/WinXPProSP3x86

It was linked from one of those college subdomains; I’ll try editing that link in a few since it had a different serial

Wherever you want, as long as SHA256 checks out.