We don't use this so I disable it

The Windows biometric service gives client applications the ability to capture, compare, manipulate, and store biometric data without gaining direct access to any biometric hardware or samples. The service is hosted in a privileged SVCHOST process.

I also disable WIA (Windows Image Acquisition) if the user is not going to be scanning or using a camera.