I would highlight three main lines regarding the security of the VPS
1. The issue of hosting provider certification and the qualifications of their personnel in the field of information security. It has been resolved by the absolute majority of hosting providers, especially by large market players. That is, choosing a reputable provider with positive reviews and implemented certificates will help to avoid risks at the level of Data Centers.

2. The issue of security associated with the shared use of computing resources, despite the localization of resources allocated within the VPS (virtual private server). Large market players are continuously implementing updates, both software and hardware. That is, the risks of compromise are extremely small. And choosing an inexpensive dedicated server will completely remove this issue.

3. The most important aspect is security at the software level of both the self-hosted CRM itself and the operating system on which this CRM will be installed. So, here are a few recommendations that may help you make a decision:
a. The OS and self-hosted CRM software should be up-to-date, with the longest possible support period and security updates release period.
b. You should take care of the security of administrative access to the server: VPN, strict firewall rules, replacement of standard access ports, restriction on the list of trusted IP addresses, two-factor authentication, as well as any tools that will hide/encrypt traffic between the server and the administrator.
c. Access to the CRM interface should also be limited in all possible ways. Probably one of the most common solutions is two-factor authentication, that is, you should pay attention to software products that have this function.
d. Regular installation of updates. Of course, it concerns security updates for both the VPS operating system and the CRM.

The comments above rightly noted that the risks of compromise always remain, but following basic procedures will make your VPS more secure for hosting sensitive data.