In general I was curious to see “what’s under the hood” of a kernel-level service and a userspace-level anti-cheat and what are the implicit security risks for an average user.

This answer isn't very satisfying, but the risk is complete and total. A kernel module can do anything and can hide what its doing.

A userspace anti-cheat has a wider range of risk. For example on Linux you can sandbox it so its quite safe in that case.

On Windows the most common issues user report are things like kernel crashes, corruption, etc. Things that should never happen in kernel space and potentially break an installation. These are honestly amateur projects that don't belong there.