The Docs are here...

https://www.novell.com/documentation/zenworks-23.4/zen_certificates/data/bookinfo.html

In General, most prefer the Internal CA because it allows ZCM to handle far more of the CA management and makes the admin's life much simpler.  If you change to an "External CA" you will need to tweak your Remote Control Policy to allow for that because there is a minor feature with RC that allows certs to be generated by the agents to allow for 2-way certificate verification.  Honestly, I think it provides less security than it sounds as things would be quite secure already assuming you are running "Rights Base" versus simple password but the RC policy needs to be tweaked to not require the agent cert.

Changing the ZCC CA will require every cert used by ZCM everywhere to change over.  However, there will most likely be no need to touch anything on the agents.  The number of Certificate/CA related calls we get around the product tend to primarily be from customers using External CAs even though such customers are the minority   No reason they can't work, it is just an added layer of complexity and unknowns.  If you are not comfortable with various commands around creating and managing certificates, it would be a reason to think hard about doing it.  Most of the commands are in the docs, so if you are not familiar with the processes it would give me pause.

Definitely setup a lab zone and put that on external for a while and do cert updates and know the process....

It would just trust the CA Cert on any device a Tech was using to manage ZCM that did not have the ZENworks Agent.  That is a very simple process.