Not going to decide for you ... paranoia levels can't be debated ... mod_security is a good thing ... even if it rears it's ugly head from time to time ... but once you know where to look and how to make execeptions, your site is about as secure as it's gonna be ... https with valid certs .. up-to-date Moodle/other code ... + seLinux + mod_security - what more can one do?
Let's not forget (oooh me, paranoia level stresser coming ....) that web is just one attack vector on a typical Linux flavored server. There is ssh and db server also ... if aware and one is hosted where one can control ... move default ssh port from standard port to higher and db server config'd for 'localhost' only ... no remote access. Do you really need PHPMyAdmin?
'SoS', Ken