PKI Installation

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a domain controller or on a server running other services (WSUS, ...). I would like to know from a security standpoint what's my best option and why? Best regards,