Ultimately I think the main danger is a skilled attacker targeting the system. That said I would like to secure data from a local attacker as well. Ultimately I understand that it will be difficult to secure fully against someone with hardware access but any risk mitigation practices I could use?

Which doesn't help one bit when some script kiddie xss-es their way into your admin backend or SQLis your entire DB out through your un-updated ad server or contact form plugin...

It does help if a thief walks out with your server, or if some extremely uneducated and unprofessional law enforcement power down your server as they serve their warrant on your datacenter - but neither of those scenarios are anywhere near the top of the "reasons your sensitive data got compromised and showed up on pastebin" lists.