Just curious really, since I have a Vista system but no Server 2008 key. In theory, you should be able to use anything that still works on Vista (and R2 should be able to use anything, since Windows 7 is still supported by everything, at least for the time being). On the other hand, a lot of security software does not officially support any server, and there may be artificial blocks - or issues related to Server 2008 updates released after Vista's EOL in April 2017 (e.g. the Meltdown and Spectre patches). Server 2008 will of course become an unsupported operating system very soon, so security software seems like a timely topic for diehards to discuss.
I'm sure you could use Avast 18.8 (which I'm using on Vista), or its near-twin AVG 18.8 if you prefer. There was a serious compatibility issue with these legacy versions when Server 2008 SP2's build number changed to 6.0.6003 after the April 2019 updates, but Avast became aware of the issue thanks to a spiceworks thread and issued a micro-update to correct it on June 4, 2019.
I'm especially curious if anyone is using Microsoft Security Essentials 4.10.209.0 on Server 2008. MSE never officially supported any server, and I believe that Microsoft blocked installation - but that can reportedly be overcome. MSFN member @Werewolf's March 24, 2017 post showed MSE working on Server 2008 without the pre-EOL nagging that affected users running Vista, but did not discuss installation procedures. Definition updates for MSE will reportedly continue after January 14, but no one knows for how long.
I also wonder if anyone is using Sandboxie on Server 2008. The Meltdown and Spectre patches reportedly caused issues with Sandboxie, at least at one time. (I'm using Sandboxie 5.22 on Vista 6002 without the M&S patches.)