The only thing you should really ever do if you have legal concerns: contact legal, and only legal, immediately in a way that preserves attorney-client privilege. If you have concerns about personal legal liability, then contact your own lawyer.

Openjdk is fine for commercial applications. If you have commercial code openjdk will work fine. Just make sure that flag isn't enabled.

Openjdk doesn't have all the same features as the oracle jdk (javafx etc)