A few thoughts....

Get the iso for Windows from Microsoft. A manufacturer is doing the same thing. They just add their own "helpful" software and things to it. I guess drivers too.

Use a virtual machine to prep the image. Then you don't have to worry about drivers.

Only use one account. For some reason, if I had a second account, it just would not remove everything for the other account's Microsoft Store apps. That causes sysprep to error out.

You don't have to use an unattend file. It's one less thing to complicate things. You can do the sysyprep through the gui (with making a checkpoint on the VM first before you sysprep it).

Yes, for checking the generalize and oobe for sysprepping.

I don't worry about drivers in the image. Ideally, I don't want any drivers in the image. I just put the latest drivers on the specific machines after imaging.

You can do a disk cleanup before sysprepping. That will get rid of some garbage that doesn't need to be on the image.

I do resize the Recovery partition, now to about 1.3MB. I was moving it "to the left" of the C:/OS partition but Microsoft will probably put a new Recovery partition to the right at some point. I don't think they will if the existing recovery partition is big enough though. If C:/OS is all the way to the right, it makes it easier to clone to a larger hard drive later. Then again, it's not too much work to move the recovery partition and then expand C, and cloning to a larger hard drive isn't going to come up much in the future for me now I think.

I don't really maintain the golden image. I'm not super pressed for time. A lot of my machine are imaged 100% offline and then get OS updates moved over to them and installed. The latest drivers go after imaging too.

A really simplified workflow might be..... Use a VM. Use the correct type of VM so it works with UEFI physical machines. Install Windows off the iso from Microsoft. (Make a checkpoint and try sysprepping it make sure it works from the very beginning. Then rollback the checkpoint and continue.)Update that and install whatever software and settings changes you want. Watch out for software that uses a unique identifier and can't be generalized -- If you have that, then just install it after imaging. Chances are it probably needs an update later anyway. Checkpoint the VM as you go so you can always go back without too much effort to recreate what you just did. When it's done for software and things, do a disk cleanup. You can also defrag the disk -- Even though it's a VM and possibly also running on an SSD, if you defragment it, it still will squish all the file parts together more. Shrink the OS drive down (and then I guess move the Recovery partition all the way on the right over to the left if C is shrunk, so yeah, moving the recovery partition might be easier). Then you've got the allocated partitions on the VM shrunk down as much as possible. Checkpoint the VM. Sysprep it and have it do a full shutdown. That VM never gets started up again after it's sysprepped. Capture the image with whatever cloning software you like. Probably roll it back to the last pre-sysprep checkpoint so it's ready for more if you need to (except then if you do windows updates or something, you'll probably want to do another disk clean up and more defragging to shrink it down more again). If it's just windows updates though, it might not be worth the time to constantly update the golden image compared to just letting imaged machines do another OS update. More likely, at some point you might change something in your set up or realize you forgot a detail or two in the golden image, and then those might be more worthwhile to go back and change on the golden image.

Best practice? Does it matter if it works for you and if you end up with the same set up as other method? Imaging completely offline appeals to me and works for my set up. I've also been able to image machines while travelling or offsite with possibly no internet.

The basic idea is sysprepping from a Microsoft iso though, nothing from the OEM. OEM to me means bloat with whatever extra crap they install. A trial version of Office. A trial version of Adobe software. Then you have that garbage to deal with on the machine and never quite know if it interferes with something else later in the life of the machine.

On the physical machine that gets imaged, you need to do things like allow network or usb booting, disable secure boot, maybe switch RAID v AHCI hard drive type, etc., in order to apply the image.