An airgapped machine is certainly going to be most robust from external attack, but even then you should probably encrypt your files to ensure privacy should you ever discard, or otherwise lose control of, the storage media.

An encrypted partition may be sufficient, but your journal entries will still be “plain text” when it is mounted, and so you will be able to read them without extra effort. If you want to make it so that once an entry is written it is encrypted and can only be read with deliberate effort, you could use GPG encryption.

First generate a key pair with a really strong passphrase, and store it on a USB drive. Then import just the public key onto your journaling machine and store the USB drive somewhere safe. With just the public key on your machine you can encrypt files, but you can’t decrypt them. Ideally you’ll set up your journalling tool to only write via GPG, but if not, you can just encrypt each entry after you write it.

As to what journalling tool to use, I like VIM, although I know not everyone gets on with it. You can have it start up with a template ready to go, not write temporary files, and save via GPG so the plaintext never hits persistent storage.