1) Does this sound like a reasonable plan? Is it overkill?
2) is it reasonable to not use a passphrase with a 2/3 multisig wallet? It seems like another way to get locked out of your BTC despite also making it more secure.
3) What would be the ideal distribution of these devices (the laptop w/ Sparrow , Ledger and Trezor), the two pins, the sparrow password, the three seed phrases, and the single file of the xpubs?
Your idea is reasonable, this is a subjective matter, you're the one who know better for yourself. You can consider to backup your seed phrase in steel plate or something that resist against fire, corrosion etc.
4) Is sparrow a reasonable multisig wallet or is there a better application?
Sparrow is already a good wallet, other wallets are nothing different.
5) Which anti-malware and/or antivirus software should I use on the laptop? Free ones would be nice. And any thoughts on which cheap reliable laptop to choose?
Not an anti-malware/antivirus user.
6) if I log into my account on sparrow on my home Mac does that compromise my security, even if I'm not using the private keys and just checking the balance in a watch only account? Would it be better to use some other application instead of sparrow for checking my account?
It's not, the another alternative is track in blockstream.info by using their onion address.
7) i've also heard that it could be useful to run the browser Tor which helps anonymize my browsing when I'm on the sparrow app. Is this necessary? Also seems like another piece of complexity that I would rather avoid if it doesn't make a big difference. If I use this browser, can I still use it on Windows if I buy a Windows laptop?
Tor, Mozilla, Chrome etc are browsing software.
Windows is a operating system, like Mac, Linux etc.
Of course you can use Tor in Windows, but it doesn't as good as using Tor in Linux since Windows is a spyware.

I've also heard that if you lose your x pubs you lose access to all of your bitcoin,
Nope, xpub can only track your address and all the transactions, you can't have access to your coins.
But if someone have your xprv, they can access your coins.