http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/which-config-to-use
To summarize, if you don't think the NSA has influenced secp521r1, the default ECC configs would be the strongest option. If that is a concern for you, Ed448 would be the next best option. If you care more about speeds than security, Ed25519. If you're using some ancient version of OpenVPN, you're stuck with RSA.