Personally, I would store the file as it was uploaded, and then render it as a PDF for users when they download it. Your spec may say PDF now, but you want to have the flexibility should things change in the future.
Is this a good idea? That is a tough question, and really depends on the exact scenario. Personally, I would push back on this requirement. Format conversion can tax system resources, and I don't think you can really constrain the .doc and .xls formats enough, like you can with images, to be something reasonable.
Tools? The Printer, email and PDF versions module has a list of of the PHP-based PDF modules:
I am unaware if any of these will support .doc or .xls formats. I have used Ghostscript to convert images to PDF, and I am pretty sure it has some support for .doc. I am unaware of any Drupal-ready solution for this, though.
As for security implications, the scenario "makes my spidey sense tingle", but I can't point to anything in particular. I don't think you would have any problems with any of the malicious payloads in .doc and .xls files that normally affect Windows machines. However, if you go with a solution like GS, you will have to use a
popen() or something similar, so you run the risk of an exploit there.