For maximum security & privacy, go with GrapheneOS (used to be CopperheadOS back in the day). Caveat is that you won't have Google Play (or even MicroG), which means some Google apps (and paid apps) won't work and if you want apps from Google Play then you need to install Aurora app.

If you want the above, but also want access to Google Play apps, then install CalyxOS.

The third option is LineageOS (was originally CyanogenMod back in the day). This custom ROM is the most accessible for a variety of devices. It's good for privacy, but, because the bootloader is left unlocked (which may or may not be relevant depending on your threat model), it is the least secure of the three.

Both GrapheneOS and CalyxOS have very user-friendly installation methods, but exist primarily for the Pixel line of devices. LineageOS has the most involved installation process, but it's available for the widest variety of Android devices.

I've installed all three ROMs on several different devices. For the average person, CalyxOS will probably be the best bet (though I think the Trebuchet launcher in LineageOS is better).

It depends upon what is available for your device and what you want out of the firmware.

What I will suggest is looking at the device specific forums at XDA. You will get an idea of what is available and what is reliable. Personally, I shy away from distributions that don't include a "what works" and "what doesn't work" section in the first post. I also prefer "official" distributions. At the very least, it is easier to track updates. The next filter I use is feature based. In this context, look for distributions that don't include Gapps and offer additional privacy enhancing features. Once you have something that you think you want, read the thread for the distribution. It often reveals pitfalls, variations within the model, and variations between carriers. These pitfalls exist even with the popular distributions, which is another reason to check out the forums.

I went with OmniROM this time around, but I have been happy with Resurrection Remix on other devices. Some devices have nice alternatives that are specific to them. As an example, I use KatKiss on the Asus TF300T. For a while, it was running a more recent version of Android than my much newer phone!

I personally use a Pixel 3 running Grapheneos.

You need a non-Verizon version of the device to do so, but there are services out there that'll hunt the devices down and even install the OS for you if you lack the time/patience https://grapheneos.org/ https://noagendaphone.com/