Checking the root certificates of my browser I see that almost all
Root CAs are using SHA-1 or below.
The signing algorithm used for the trusted root certificates is unimportant. Signatures are used to establish trust. By definition, a trusted root certificate is one which you implicitly trust based on provenance (e.g., where it came from and how it got into your trusted root store - by the OS/browser installer, by Group Policy, etc). The signature of the trusted root certificate is never verified against the signer (and they're generally self signed, of course). Rather, signatures are used to verify untrusted certificates that are handed to the browser on the fly by the not-yet-trusted server.
That being said...... it is probably worth using a SHA-2 signed cert for your internal CA because people look at certificate chains and assume SHA-1 bad, SHA-2 good. If you go with SHA-2, you won't have to deal with people asking you this very question :)
1) Should I change from SHA-1 to SHA-2 on my internal Root CA or
change the web site's certificate is enough?
It is not necessary to change the root certificate to SHA-2, but it may help avoid questions from users and auditors.
I would not go through the trouble of re-issuing existing certs; I would create a new SHA-2 root and use it for all future certificate signings. That way the SHA-1 version of the root will go away over the next few years as your existing certificates expire.
2) Today, what is the impact of Root CAs using SHA-2 in browsers? Is
there any browser yet that doesn't support SHA-1? Some of our customer
still uses old versions of IE.
I assume you mean "browser [that doesn't yet] support SHA-2?" Yes, there are still old versions of browsers out there that don't support SHA-2 (nifty compatibility table), but if your users are running those, they should be forced off them for general reasons, not because of your root CA.
3) Will browsers stop trust Root CAs that use SHA-1?
I would not be surprised if that happens, years down the road, because of the "appearance of security" issue that I mention above. But not quickly because, again, in technical terms, the browser doesn't use the signature on trusted root certificates.