Convert Uploaded Files To .pdf
Personally, I would store the file as it was uploaded, and then render it as a PDF for users when they download it.  Your spec may say PDF now, but you want to have the flexibility should things change in the future.

Is this a good idea?  That is a tough question, and really depends on the exact scenario.  Personally, I would push back on this requirement.  Format conversion can tax system resources, and I don't think you can really constrain the .doc and .xls formats enough, like you can with images, to be something reasonable.

Tools?  The Printer, email and PDF versions module has a list of of the PHP-based PDF modules:


dompdf
mPDF
TCPDF
wkhtmltopdf


I am unaware if any of these will support .doc or .xls formats.  I have used Ghostscript to convert images to PDF, and I am pretty sure it has some support for .doc.  I am unaware of any Drupal-ready solution for this, though.

As for security implications, the scenario "makes my spidey sense tingle", but I can't point to anything in particular.  I don't think you would have any problems with any of the malicious payloads in .doc and .xls files that normally affect Windows machines.  However, if you go with a solution like GS, you will have to use a popen() or something similar, so you run the risk of an exploit there.