"Who the culprit is is not the issue here" is correct. "Who the culprit is" is the noun clause- only part of a sentence. "who is the culprit(?)" by itself is a full question.

The second one is best.