I think you forgot another option for self-hosting: hosting agents with docker image on AKS. The pods will be automatically restarted after each agent job. This is especially useful if you already using AKS clusters and you can prevent vulnerabilities by using either vulnerability free images or building docker images each night. You can even go down the route of hosting agents on different AKS clusters in different regions which will provide you high availability/disaster recovery functionality for your enterprise.