Run KernelEvents::REQUEST event before hook_node_access?
OK, after a bit more digging, I found the solution.

The "weight" param for ['onKernelRequest', 1] is sort DESC, so the higher weight number will run first.

Adjusting the event listener with weight 1000 as follows means it runs before the hook_node_access invoking listener

  /**
   * The subscribed events.
   */
  public static function getSubscribedEvents() {
    $events = [];
    $events[KernelEvents::REQUEST][] = ['onKernelRequest', 1000];
    return $events;
  }