It depends. Sometimes the segment creation may require too many rules that either makes it difficult to create it or make Workspace to slow down. Obviously, try with the segment first and if you realise it's too complex, consider a classification.

The attribution last touch, first touch or other can be configured in the metric setting (click on the gear icon when in Workspace). What I meant is when someone clicks a link with CID on websiteA and as a results lands on websiteB, the referrer may not return websiteA. If it happens, the referring ...

Those who came via CID=1 and then directly will be reported as those who came via CID1.

I presume, as per the extract it may not be allowed to pass any Personally Identifiable Information information and maybe even customer IDs, but is there a statement that prohibits to collect anonymised information?