Since Node 12 is the true minimum version, should I update package.json to that version in this PR? 

Yes, if 12 is actually required, it seems useful to reflect that in package.json

Should I just update circleci to Node 20?
Yes, no concerns

Should the package.json min Node version be updated to 16?
No, not until prebid 9

For the next major release, it probably makes sense to update the min node version to at least Node 16 but maybe the current LTS?
Seems 16 is fine in prebid 9

Originally posted by @patmmccann in #10990 (comment)