Interfacing SPI (MCP3903)
SPI0 and SPI1 are used internally to access the ESP32’s attached flash memory. SPI2 and SPI3 are general purpose SPI controllers, sometimes referred to as HSPI and VSPI, respectively. They are open to users.
A quick google search shows:




So you can use IO5, IO18, IO19 and IO23.