Security setting for SQL Server services
The engine provisioning Setup makes them sysadmin members, as documented at Configure Windows Service Accounts and Permissions:


  SQL Server Per-service SID Login and Privileges The per-service SID of
  the SQL Server service is provisioned as a Database Engine login. The
  per-service SID login is a member of the sysadmin fixed server role.
  
  SQL Server Agent Login and Privileges The per-service SID of the SQL
  Server Agent service is provisioned as a Database Engine login. The
  per-service SID login is a member of the sysadmin fixed server role.


If the product Setup makes them sysadmin is better you follow the same practice.