Sometimes the audit is unavoidable. Recently went through one, and my first thought was "wait, people still use oracle jdk?". Thankfully not my job to deal with, but I guess some companies never migrated off which blows my mind, but, to each their own I guess. Oracle is coming around looking for a paydays.
The jdk itself is fine, but the licensing terms are ridiculous. To their credit they waited to implement the terrible terms until there were multiple drop-in replacements.
About what version should you use, if you are deploying whatever you are doing, i would stick to the latest TLS(Currently 17). But if you are trying to make an app that expects people to have a JRE, then probably using the 8 TLS would be a better option and easier for users to deal with (Unless you are targeting programmers or linux users, then again, latest TLS would be imo best option).
basically anything besides Alibaba or Oracle you probably won’t notice a difference. at work I use corretto since we deploy on aws, at home I either use Temurin or Corretto. One thing benefit of Corretto is they do tend to backport some patches to older versions if you aren’t able to use the latest yet. https://whichjdk.com/
There was another JDK, I think Azul but I might be totally wrong, that had a unique feature (in the non open version I believe, sadly) where garbage collection (or some other event) only stopped individual threads instead of all of them at once.