I'd say spin up the VMs on a machine that doesn't matter if you're attracting automated attacks.

If you wake up one morning to an exploit being discovered and have an unpatched host machine, is it still a honeypot?