The only safe PC is a SPARC
Both Intel and [most of the] ARM [community] are guilty of bundling opaque processor controls, and the i386/ARM architectures cannot be trusted as the opaque components have unrestricted access to networking, memory, and i/o.
It appears that the best "open" CPU architecture is the decade-old SPARC T2 - the full Verilog source for the CPU is provided, and there is no "management engine."
Unfortunately, no "Raspberry Pi" or otherwise reduced form-factor board is available on the market at this time. If you want to run a SPARC T2, you will likely have to purchase a used Netra server.