IMO minimal permissions for user running Zabbix agent service strictly depends on required tasks/metrics to collect from the device.
Long story short, it will vary in multiple scenarios, and such minimal requirement would only add some frustration and questions like - why do I need that if the only task of this agent is to report agent.ping

Added to documentation for 3.0, 4.0, 4.2.

"Functionality is limited" - what does it means:

1. to access windows event log via eventlog[], you need to do: https://support.microsoft.com/en-us/help/323076/how-to-set-event-log-security-locally-or-by-using-group-policy
   if this is just txt log for log[]/logrt[] - right to read the file is enough.
2. If system.run makes access to resources with limited access - for example, files or windows registry, the result will depend on the user rights to access these resources.
3. vfs.file - the result will depend on the user's rights to access the polled resources.
4. wmi.get - a complete answer is not possible. Access depends on vendor settings. Different vendors can expand/change wmi with limited access. You need to consult your vendor's documentation.