What are the security and privacy concerns surrounding using a custom android ROM like that of cyanogen?
I would say the biggest issue with a lot of custom ROMs including Cyanogen's is that the OS and system apps are signed with test keys. These keys are publicly available, meaning that it is possible for someone to write an app that uses "signatureOrSystem" or "signature" level permissions. There are known cases of malware that targets these custom ROMs [1,2].
On a more positive note, if you run a rooted devices, you can do things like set up a host file to block ads, enable a firewall per application, selectively disable permissions, etc. Custom ROMs often ship with newer kernels, so a lot of security vulnerabilities that are kernel-based are dealt with faster than what Google can do.
Well, it is open source so you can look at the code and build it yourself if for any reason you don't trust the binaries that are shared.
I believe the only data they collect is from crash logs, and maybe the number of installs (I can't find a source for this if anyone can help me out here).
Other than that, a lot of people use it as it is probably the most popular rom out there. If there were privacy issues, people would be all over it.