Is the OVA secure enough for production?

Is it recommended to push the pre-packaged Ubuntu based VM into production?

What is recommended to build an enterprise grade hardened graylog cluster?

No: http://docs.graylog.org/en/2.4/pages/installation/virtual_machine_appliances.html#readiness