I have implemented a 2-tier Windows AD CS PKI. For 802.1x I'm using autoenroll to distribute computer certificates automatically to any domain joined computer.
Currently I use a single computer template for all computers, both servers and workstation. This template includes client authentication, server authentication and remote desktop authentication EKUs.
For workstations, client authentication is all that's required, but is having the extra EKUs set in the certificate a security issue?
(By default there are no groups seperating servers from workstations, so you cannot assign different autoenroll certificate templates to servers and workstations. It's possible to ceate a server group and add servers to this group, but this adds an extra manual action.)