have seen few storages from salesforce Platform Cache and Session Cache, any idea how these works with security review and are these are replaceable for window.sessionStorage?
Platform Cache is not a replacement for your stated intention, which is to reduce server calls. It is a technology meant for Apex to reduce CPU usage by avoiding recalculating expensive algorithms every time you need the value in Apex. You need to call the server to access the cache. It's the server-side equivalent to window.sessionStorage.
If so what would be the best and secured way of storing the data(which is not confidential though, and even we're encrypting it) in any session or cache
If it's not confidential data, you don't need to worry about encrypting it while at rest on the client. Store it however you want.
Will it be flagged under any security vulnerabilities?
No, it's just non-privileged data that you're storing for later use. It'd be no different than storing data in a variable. Most users wouldn't know how to view or modify that data anyways, as they're not programmers, and someone with enough skill to hack the data would only be modifying their own local copy, so it's not a security vulnerability in any real sense.
Also any best practices for security review related to session storage could help us.
Don't store usernames, passwords, birthdates, encryption keys, or anything else considered even remotely sensitive in a client-side cache unless you have a very compelling reason. Commonly public data is perfectly fine to store the in the cache; if it's sent the browser, a user can easily read the data anyways if they have the skill to do so, so it's not exactly a secret, encrypted or not.
For actual secret data, read Secure Coding: Storing Secrets.
