A suggestion for you.
A few years ago, a client asked me to look at saving the life of a very important but quite old specialist machine tool in their factory. The control system was using 2 Windows 3.1 PCs. The custom written control system software would not run on Win9x or later OS as it was hard coded for the specific PC and graphics card. The company were desperate to find a solution because the machine was going to be very costly to replace and with a 2 year lead time so they needed to buy some time.
These legacy PCs had no USB ports and only floppy drives (long since broken) for backing up so the company had always struggled to back them up were therefore very vulnerable to hard drive failure. Also, the PCs kept breaking down and spares were really hard to get.
Special Force Patch Download
So, what I did was virtualize the 2 Windows 3.1 PCs complete with their application software and ran both of them inside a single modern PC. The one application required LPT port support and so was run in MS Virtual PC and the other had some special graphics modes which required VESA emulation so I used Oracle Virtual Box for that. I got the 2 PCs to talk to each other via a virtual network and was even able to access them remotely through the host for backing up. Also we were able to protect the host PC with a UPS which would not have been possible with the originals (at least not with controlled shutdown anyway).
So, could you not do something similar. From what you describe, your WIndows 2000 PCs and custom app are not using any special or dedicated hardware so could you not virtualize them in a VirtualBox VM and run them inside new PCs. Yes, if the Windows 2000 system is accessing the internet/network, it would still be vulnerable but at least it would be running inside something that is fully protected and patched and would be very easy to backup and/or recover in the event of a problem.
Windows 2000 Patch
Updates to pcAnywhere 9.x are no longer available via LiveUpdate. To properly install pcAnywhere 9.x under Windows 2000, you must download the patch file 921up.exe. Download this file and have it easily accessible on your desktop before proceeding with the installation. May 16, 2017 Hi! Is there any security patch (Vulnerability of MS17-010) available for Windows 2000 Server? You could perform a workaround that block port 445.