First thanks you for your feeedback i appreciate any type of feedback 
You’re 100% right about the machine-id i was thinking to modify the .sls file just for this. But is it very useful to change the machine-id ? 
VM Fingerprinting and see also this forum post How to hide the fact that I'm Qubes OS from Telegram Telegram was able to identify this user as a Qubes OS users on a Whonix VM. I don’t really see the point of “masking” the machine-id because a app have so many way to identify you as a Qubes user
Example : When i was doing a apparmor profile for Brave-browser i realized that if a user click on “Sync” to sync his data in Brave then the browser will put the current hostname of the user.
Another example when i was (again) doing a apparmor profile for browser and other apps i’ve seen a lot of them is trying to read “proc/version”
If you enter this command in your terminal
cat /proc/version
This will display your current kernel version and it will show that your current kernel is Qubes. So basically every apps can easily detect you as a Qubes users. Apps doesn’t even need to access your machine-id to detect you as a Qubes users. Which is why in every apparmor profile (except those who doesn’t have access to network because i removed ) i added this line deny /proc/version r,
Another creepy example of why hiding the machine-id could be useless Brave can easily track and fingerprint you in Qubes in this Privacy Guides post this user showed which data the browser collect by default and some of them can easily track you.
Something that could solve the issue would be to create a apparmor profile to deny access to machine-id , proc version and some other things to every apps but i didn’t think about this until i saw your post 
this is maybe possible to do. I will do some test thanks for the idea but i don’t think this will be possible. I think doing /usr/bin/* and /usr/lib/** could work i will give some feedback about that.
Hm… apps like signal, firefox etc… need to download file somewhere i can’t completely deny access to every folder in home directory but you’re right i need to be more clear on this part
??? What are you talking about ? which gui tool you are referring to ? As far i’m aware you shouldn’t start a software in the template VM. Did i missunderstand something here?
Yes i saw that yesterday the issue affect every OS (Ubuntu, Debian, Tails, Whonix, etc…) i can’t do nothing about it a fix in the kernel has been merged https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.19.8
Maybe we should only use SElinux ?
This is normal security has a cost but i think some parameters can be removed but i don’t know which one should i remove in favor of performance maybe you could help me with that ?
Thanks you again for your feeedback.