You make a comment that predetermined security questions are more likely to be guessed by attackers than user-defined questions. That assumes your average user will design a better (e.g. more secret, less guessable) question than the people implementing the system. This doesn't seem to be true for most users.
In one lab study subjects only spent an average of 15 seconds coming up with their own security question. That's very little time to think about the characteristics of a what makes a good security question. In a different study researchers asked people creating security questions what they considered important factors when designing their questions. 70% identified "memorability" as a very important factor, while only 44% said "security" was very important. So letting users write their own questions will often result in worse security because they're focused on making them easy to answer, not resistant to guessing.
I was able to actually observe this behavior a bit in a study I conducted a few years ago on user-defined security question/answer pairs that were leaked during several website database breaches. I found that many of the questions were the same type of thing you'd expect to see in predefined security questions lists: Mother's maiden name, pet's name, birthplace. But this included bad questions like 'what is your favorite color' where some answers are much more likely than others, and making five guesses (blue, purple, green, red, black) would correctly match 75% of user answers.
Worse, some users would choose to completely undermine the security of the question through their choice. Some users (15% on one site, 2% on another) would make the answer match their question. A small number (0.2% and 1.8%) would even list their password as their question. In these cases anyone able to view the question could then use that info to log in as the user. You can implement controls to check questions as users submit them and try to prevent this behavior, but it's pretty hard to enforce against a user determined to circumvent it.
Security questions aren't a very good method of authenticating users, but allowing user-defined questions tends to be an even worse solution. If you are determined to use security questions, they should be evaluated and chosen by the people most qualified to evaluate their pros and cons.