Can I, and should I, verify bitcoin core source code before compiling it? If I use bitcoin core binary release I can verify them with the gpg keys of the core developers. Is there a similar process for the source code? A follow-up question: Is it preferable to use signed binaries or compile from source?
If you look at tagged commits on github, you'll notice they are also signed by the core maintainers keys, notice the "Verified" button, see bitcoin/tags and Github GPG Signature Verification.



You can verify the commits yourself if you've imported the signer's public key, see Verifying Tags:

$ git tag -v v0.17.0
object e1ed37edaedc85b8c3468bd9a726046344036243
type commit
tag v0.17.0
tagger Wladimir J. van der Laan &lt;laanwj@gmail.com&gt; 1538390952 +0200

Bitcoin Core 0.17.0 final
gpg: Signature made Mon Oct  1 04:49:17 2018 MDT
gpg:                using RSA key 9DEAE0DC7063249FB05474681E4AED62986CD25D
gpg: Good signature from "Wladimir J. van der Laan &lt;laanwj@protonmail.com&gt;" [unknown]
gpg:                 aka "Wladimir J. van der Laan &lt;laanwj@gmail.com&gt;" [unknown]
gpg:                 aka "Wladimir J. van der Laan &lt;laanwj@visucore.com&gt;" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 71A3 B167 3540 5025 D447  E8F2 7481 0B01 2346 C9A6
     Subkey fingerprint: 9DEA E0DC 7063 249F B054  7468 1E4A ED62 986C D25D



  Is it preferable to use signed binaries or compile from source?


It depends on your situation, but most likely it will be easier to just use the compiled binary. If the binary doesn't work on your system, if for some reason your system is different enough, then compiling from source might be better. As long as you verify the signatures it shouldn't matter whether you run the binary or compile from source, the binaries are just provided for convenience.