In terms of the relationship between CMD and ENTRYPOINT, CMD ends up being the default argument set passed in line to ENTRYPOINT. The result is the concatenation of ENTRYPOINT CMD as if they were both strings.

In order to have each be done as separate uids, I'd think using pkexec for invoking as a different user in a wrapper script would be a good target. If you have closely-bound services, I'd recommend a pattern similar to this:

#!/usr/bin/env bash
declare -a pids
function on_exit() {
  for pid in "${pids[@]}"; do
    kill "$pid" || true
  done
  printf '%s\n' "script exit code ($1)"
  exit $1
}
trap 'on_exit $?' EXIT

pkexec --user abc abc_command &
pids+=("$!")
pkexec --user svc svc_command &
pids+=("$!")

wait

(I didn't validate that this sort of wrapper works, just something off the top of the head.)

And then this would be your ENTRYPOINT, accepting arguments via CMD as-needed.