As @Maurice said, lambda@edge will be more expensive. And you should also consider the impact on your latency especially if you add your lambda@edge on your viewer request... CloudFront access logs would be the best approach and if you need more logs, you can try real-time logs. That will give you access to cs-headers field that should contain what you're looking for. Downsite would be the cost, real-time logs are more expensive than standard access logs.

Other option would be to use Cloudfront Functions, it's basically like lambda@edge with much less feature but the cost and latency are much better. You won't be able to use DynamoDB, but you can write some logs

And for your question about targeting only the first page load, you should be able to do it by checking the referrer header value. It should be different than your host value.