As long as the key file is sufficiently long and difficult to guess, anything goes. The contents of the key file will be hashed anyway before being used together with your password. That is, if it is a 4 MB large JPEG file it will still be hashed down to a few number of bytes (in comparison to the 4 MB file).
KeePassXC can generate a key file for you and it will be a sequence of 128 random bytes. That is enough.
The purpose of the key file is simply to "automatically" tack on some extra characters to your password. The reason for doing so is that it will address various scenarios where a password alone or a key file alone would fall short. Here are two such scenarios:
Scenario 1 (only password, no key file)
Suppose you store your KeePassXC database in Dropbox and a rogue Dropbox employee has managed to get hold of your password (or been lucky guessing it right). This perpetrator could simply unlock your database with the password. Had you instead also used a key file (that has never been uploaded to Dropbox) the rogue Dropbox employee would be sitting with only "half" your password, hence cannot unlock your database. Another classic scenario is where a key logger has been used to obtain your password. With a key file, only "half" your password has been picked up by the key logger.
Scenario 2 (no password, only key file)
A thief breaks into your home, opens your computer and unlocks your KeePassXC database with your key file. Here a password would have stopped the thief.
Combining password with key file
Using a key file and password would address both scenarios above. Whether the key file should be "hidden" is only a matter of obfuscation. Once the thief in Scenario 2 is in your house, he or she could simply try all the files on your computer (and perhaps use some computer forensic trickery to speed up the search). But most likely, opening KeePassXC would directly provide the path for the key file up front as it is usually already filled in.
The idea of the key file is to have something that is impossible to guess and is physically separated from someone doing the attack. The password on the other hand is there as a barrier when someone has all the physical means of getting into your personal stuff.
Obfuscation is often a weak, deceiving layer of protection, and depending on your threat scenario may as well be avoided. It adds very little extra protection at the expense of perhaps making your life harder and giving you a false impression of being better protected.
What key file to use
Again, something sufficiently long and random will do. KeePassXC will generate 128 random bytes. Do not forget to back up your key file in case you lose it! If your intention is to write down your key file and store it somewhere then printable characters might be a good idea. Just make sure it is long enough and random. Here random means something that cannot be guessed. Once I used the text from an embroidery we have at home. It was around 300 characters and I did not have to make a backup of the key file as it was sitting there on my wall. In case of fire I could go though photos of our home to recover the text.
