Subscribing to item:saved where you can access item changes and do lots of efficient exclusion.

gistfile1.cs

Event.Subscribe("item:saved", this.Item_Saved);

private void Item_Saved([NotNull] object sender, [NotNull] EventArgs e)
{
  var changes = Event.ExtractParameter<ItemChanges>(e, 1);

  if (!changes.IsFieldModified(FieldIDs.Security) && !changes.IsFieldModified(FieldIDs.Workflow) &&
      !changes.IsFieldModified(FieldIDs.WorkflowState))
    {
        return;
    }     
}