Many thanks all for your comments and insights - I appreciate this is a question where the answer is not a simple one.
As to DPA/UK GDPR, fair points and not something I had considered.
I agree that upgrading to current versions of PHP/MediaWiki should be the immediate focus (
board.wikimedia.org.uk also runs 1.31.0)
To your comments Mike irt "fresh thinking", perhaps WMUK would consider a hybrid approach? Maintaining your own private wiki(s) but having the public one hosted by WMF, which would give you the benefits of being SUL joined etc.