Transit Gateway routes

It is recommended to have dedicated subnets for TGW attachment ENIs in every VPC, so for your question: in step # 2 once the TGW sends the traffic to Service-VPC the traffic should land in the dedicated subnet for TGW attachment ENIs, after that the route table associated with that subnet would decide the next hop.

Also, it sounds like you are using 3rd party Firewall in the Service VPC, have you looked at Gateway Load Balancer for this use-case? Gateway Load Balancers make it easy to deploy, scale, and manage third-party virtual appliances, such as security appliances.

https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/getting-started.html