SQL Server DML auditing - Triggers vs SQL Server Audit Feature (vs temporal tables vs change data capture)
CDC and temporal doesn't say who did the modification.
Audit has lower overhead than triggers. Audit uses extended events under the covers.
Audit might not give you which rows where read or modified (when parameterized sql is submitted), but that wasn't a prerequisite. I. e, I'd look at Server Audit first.