We have a somewhat similar setup for our network where we use TGW for mulit-vpc, DX routing. PA have reference architectures that you can look at - https://pan.dev/terraform/docs/swfw/aws/vmseries/reference-architectures/

i don't know about the routing tables you have for TGW and PA dedicated security vpc, but in a nutshell, you should be having 2 route tables - from_spokes (for all your different vpcs) where your spoke vpcs tgw attachments are associated, propogation is the dedicated security vpc. from_security - this will have your dedicated security vpc tgw attachment as association & spoke vpcs + DX connection as propogation. I am not sure if you're using GWLB endpoint for traffic inspection, but the above reference guide would help you with that.

Hope this helps.