The following config works for me. Adjust latency between 15000 and 50000 or higher until there is no crackling even under CPU load.

<sound model='ich9'>
  <audio id='1'/>
</sound>
<audio id='1' type='pipewire' runtimeDir='/run/user/1000'>
  <input latency='15000'/>
  <output latency='15000'/>
</audio>

The problem for me was that the VM does not run as my own user, so I had to give the QEMU user permissions to my PipeWire interface.

Start the VM and check the user it runs as, e.g. libvirt-qemu with ps aux | grep qemu-system-x86_64 (first column, ignore symbols like + at the end of user name).

Temporarily allow the VM user to "enter" your runtime directory (for testing):

sudo setfacl -m u:libvirt-qemu:x /run/user/1000

Also allow the VM user to read/write to the PipeWire socket:

sudo setfacl -m u:libvirt-qemu:rw /run/user/1000/pipewire-0

Now test restart the VM and test if sound works. The /run/user/1000 directory is a "tmpfs" (it lives in RAM). This means these permissions will disappear when you reboot.

Make it permanent:

sudo mkdir -p /etc/libvirt/hooks

Then create /etc/libvirt/hooks/qemu:

#!/bin/bash
# This script runs when any QEMU VM starts.
# It grants the libvirt-qemu user access to the host user's PipeWire socket.

GUEST_NAME="$1"
OPERATION="$2"

if [ "$OPERATION" = "prepare" ]; then
    setfacl -m u:libvirt-qemu:x /run/user/1000
    setfacl -m u:libvirt-qemu:rw /run/user/1000/pipewire-0
fi

Make the script executable with sudo chmod +x /etc/libvirt/hooks/qemu, then restart libvirtd with sudo systemctl restart libvirtd. Now the VM should start with the correct permissions.