Last time I deleted the Gmail fake account that Android had forced me to apply for by denying me access to third party apps, Android punished me by deleting all the contact data from all my contact lists. From a legal perspective that's perfectly fine, because Android forced me to accept an end user agreement which frees Android from any responsibility for actively destroying my data. The alternative to accepting this end user agreement would have been a phone with the functionality of a brick. Google is evil.
I don't have the sufficient specialist training or experience to deal with the maliciousness of American surveillance software. I understand that ROM means read-only memory and that this particular ROM is an operating system plus payload on a flash EPROM. That's all. Please explain the rest. How do I install a new one without destroying the phone? What can I do when the rewriting process fails somewhere in the middle? Is there an emergency console or ROM management layer or something like that or does the phone simply stop responding? I probably have to gain root access to the phone first anyway. How do I do that? I can't even open the console. How do I know the new software doesn't come with its own security issues? My point, it's not really an option. It's a ton of unsolved problems.
You seem to have about three extra helpings of insane paranoia.
But beyond that, go to https://www.xda-developers.com
They can answer your questions in more detail than I can. ROM in this case refers in general to any android distribution.
XDA is your friend.
Flashing the bare minimum of google packages is already an option for most ROMS.
The problem isn't that the locations services are present. The problem is that 99% of android users leave all services/radios running 24/7. If you don't want goigle to know where you are, turn off everything you don't need. Your carrier still knows in general where you are, but that's it.