Sent this to others in the community but not sure what the outcome was but this is what I was informed that could work:
1). convert disk from MBR to GPTMicrosoft has a tool called MBR2GPT that can do that conversion. I believe that needs to be done in windows after the image has been laid down.
2). enable / disable Secure Boot, TPM, VT, VTd-x at BIOS / UEFIVendors have specific exes that can change BIOS setting while in winpe, Dell has a tool called cctk that can make those changes in winpe
3). Set BIOS password Not sure, probably post imaging once you are in windows (vendor specific)
4). Update BIOS version Not sure, probably post imaging once you are in windows (vendor specific)
5). Update the device’s driver and use HII and keep your driver repository up to date