Is there a recommended distance that should not be exceeded between a sharepoint 2016 farm and the domain controllers? Is there a performance or security issue by having the sharepoint farm located far apart from the domain controllers?
I once had a SharePoint farm operated in Europe. Company bought another company in china and established a trust between those AD-Domains. Customers requirement was to be able to resolve those new people within SharePoint, so PeoplePicker was configured for that.
Both - latency and throughput - between Europe and China were really bad because of the big distance between those systems and especially because of the performance-bottleneck of the Great Chinese Firewall. PeoplePicker performance suffered hard for all domains.
We solved this by installing a local domain controller in the same site as the SharePoint farm.
There are no security issues but SharePoint should be within the same data center as a Domain Controller for performance reasons. Depending on the authentication method used in your Web Application (NTLM, more so than other forms of auth), IIS may make frequent authentication calls to the domain controller. The longer the response time from a DC, the slower the end user experience will be.
This can cause performance issues but is not a security risk.
In this case, different environmental factors can cause network delays, request timeouts, etc., which can affect the end user's experience.
It is still recommended that you install SharePoint farm and domain controllers in the same data center.