Static sites are mostly waiting: waiting for the network, waiting for the reader. The CPU work per request is tiny — read a file, send it. A single-core machine with 1 GB of RAM can answer thousands of requests per second this way, far more than a personal site ever sees.
What actually matters is the network path between the server and the reader, and keeping the software boring: a plain web server, a current TLS certificate, nothing else listening. Every extra service is another thing to patch and another thing that can leak information about the box.
The rule I follow: if a page can be a static file, it should be a static file. Databases, application servers, and panels earn their place only when the content genuinely needs them.