FOSSOS GMSCompat (Google Play?)
GMSCompat is Graphene's compatibility layer for the Play Store, so no its not Google Play. GMSCompat and anything else loading/running in BFU state are system apps/components, not user apps.
There is a pretty long delay before the Always-on icon appears AFU
Not for me. Takes a second or 2 at most. Might be worth reporting on the github tracker.
and the VPN often fails to connect several times on GrapheneOS
Again, not for me. I connect to VPN fine. Either a problem with your VPN or, since you stated its fine on stock Android, it might again be worth reporting on the tracker.
how can I be sure nothing leaks AFU before Always-On loads?
As long as Block Connections without VPN is on, I doubt there would be. But if you can produce any evidence that leaks are occurring, you can report them to the team.