If you're primarily worried about privacy, I recommend against spoofing your user agent unless you're only changing superficial details. See https://bugzilla.mozilla.org/show_bug.cgi?id=1404608

It's very hard to fake an OS or pretend to be a separate browser. If you're focusing on disinformation, you should probably be focusing on disinformation that's harder to detect.

the useragent is far from being the only metric used by panopticlick

I know that, but the UA does provide the highest number of bits of identifying information.

is that still true since operating systems and browsers automatically update themselves now?

Fair point, that probably lowers the odds of recognition a bit, but the UA stands out because of the multiple variables that it reports in one header. At least when I ran Panopticlick a few times with various configurations, that was always the factor which gave up the most bits of identifying info.