When an anonymous user hits '/user/login' route, how can I trigger an event?
I agree with @Berdir, it shouldn't be a problem if the internal page cache stores a response for each query string.

But the issue here is probably that TrustedRedirectResponse is a cacheable response. When you use such a cacheable response you  have to add the correct cache metadata for the content of the response, here a context for the query arg:

  if ($event-&gt;getRequest()-&gt;getRequestUri() == '/user/login' &amp;&amp; $account-&gt;isAnonymous() &amp;&amp; $event-&gt;getRequest()-&gt;query-&gt;get('loginFailed') == FALSE) {

    $response = new TrustedRedirectResponse($url . '/StartPage.aspx?Site=' . $site_key . '&amp;URL_success=' . $base_url . '/user/netforum/{token}&amp;URL_failed=' . $base_url . '/user/login?loginFailed=true');

    $cache_metadata = new CacheableMetadata();
    $cache_metadata-&gt;setCacheContexts(['url.query_args:loginFailed']);
    // or set max-age = 0 instead
    // $cache_metadata-&gt;setCacheMaxAge(0);
    $response-&gt;addCacheableDependency($cache_metadata);

    $event-&gt;setResponse($response);

    }
  }


Then the dynamic page cache will vary by this context. Or add max-age = 0 to disable the dynamic page cache, because caching won't help here much, this is already cached for anonymous users.