According to the classic xkcd on this subject (https://xkcd.com/936/) 4 random common words provides 44 bits of entropy which is easily crackable (you can do a hell of a lot more than 1000 guesses/sec)
Something that uses key stretching like WarpWallet might be acceptable: https://keybase.io/warp/
You get something like 17 bits of password strength per word, depending on the size of your dictionary. (The relevant xkcd estimates more like 11 -- which makes sense because /usr/share/dict/words has a lot of obscure words, shitty words, and alternate forms of words, that you would probably exclude when generating a password.)
So if you want a passphrase that's secure against brute force, you'd want more like 7-12 words.
Not if those 4 words are in the dictionary. Crackers are definitely aware of this password generation technique and it isn't hard to run through 4 word combinations from a dictionary.
In the end, the best password right now is a 16+ random password made up of uppercase letters, lowercase letters, numbers and symbols. Use a password manager to manage and store your passwords.
It depends on the size of your dictionary. If you want to run through all combinations of 4 words from a 131072 word dictionary you need to test 2^68 combinations.
Something that uses key stretching like WarpWallet might be acceptable: https://keybase.io/warp/