If you make them private and later decide that they need to be accessible to derived classes, you can change them to be protected without affecting any code dependent on that class. You also have the option of adding protected accessors.
If you make them protected and later decided that should be private, changing them could break existing code that relies on them being available.
My personal rule of thumb is to make everything private and promote them up the visibility chain as necessary.