JPEG is an inert format which doesn't support complex extensions, embedded executable code and most other things that make PDF potentially risky. By converting to JPEG and back, you eliminate all potential vulnerabilities except for the ones in JPEG decompression. Popular image decompression libraries got a lot of security attention in the early 2010s so they should be pretty safe these days.
JPEG is bad at compressing text (its techniques are good with color gradients, and not so good with the kind of sharp contrast that text needs between background and text). So the result will be large and may be hard to read. And of course the text won't be selectable or searchable. Sanitizing the book as a PDF (or converting it to epub) while keeping the text as text would give a result that's a lot more usable.
Of course, if the PDF is malicious, it can attack the conversion service. But the conversion service is the one that takes the risk, rather than your PDF reader.
pdftk
/iText is enough. I had done something like this once, for other reasons, usingpdf2json
.