I would store them in the CR and, assuming you're regularly backing up files as well as the database, use the CR's ability to store the data in a file rather than in the DB to improve performance when they're downloaded by users.
On the other hand, if you have the CR store them in the DB your DB backups will contain all the images making restoring from scratch a simpler process. But returning them to users will be somewhat more expensive, particularly in the PG version.
As regards the expense of the CR I would say that while many have argued that it must be expensive to use none have proven that either the object system or the CR is truly a bottleneck on any live system.
The permissions system is a bottleneck, that we know, but that's due to its implementation and has nothing whatsoever to do with either objects or the CR.
