Look for a Lenovo M720Q, M920Q, or M330. All of them not only do VT-D and IOMMU but even have a real PCIe x8 slot. I picked up an M720Q for $220 CDN off FB Marketplace and it's my Proxmox server running pfSense, Window Server 2016, Turnkey-NAS (using an 8TB and a 16TB USB 3.2 Gen 2 10Gbps external hard drives), Pi-Hole, and a battery backup monitor LXC.

I have 32GB RAM in it, but even though the docs say that's the maximum I've been told by several people that you can actually put two 32GB modules in them for a total of 64GB. When the M720Q was released 16GB was the biggest RAM module you could get.

No cluster yet, but someday...

HDMI output and also input keyboard/mouse

Preferably. I remember now reading about PiKVM some time back. I will look into it again.

some of sort of repeating error

That's exactly why I want to do this. I've had some issues and want to be able to check for errors at will from any PC on the LAN and also when not at home.