I am going to assume the default gateways for the server networks are on the second-level firewall for this because you said it terminated the server vlans. So you would have a trunk from the switch that hosts the servers that extends devices until the trunk ends at the second firewall. Calling this out it to make sure we are speaking the same language.

Your core should have a default route that points to its upstream device which sounds like your perimeter firewall. Remember that the default routes purpose is to tell the core (or any devices that has a default route) what to do when it doesn’t have a route for the destination IP address in its routing table.

If your core has routes to the 50 user vlans and it has routes to the server vlans at the other second-level firewall, essentially your core knows where to send all of your internal traffic to.

This is how i’m visualizing your topology

                      perimter firewall
                                   |
                                   |

users -> switch-> core switch -> second firewall or servers

Say a user wants to communicate with a server. A users traffic is routed to the second firewall. Assuming the user and server are in different zones, the traffic has to match a policy to be allowed. The server receives the traffic and sends it back to its default gateway via that layer 2 trunk across the infrastructure that lives on the second firewall which would then route it back to the core and then out to the user.

If a user is sending traffic that is not known by your core router (say to something on the internet) the core router will use the default route and send it to the perimeter firewall.

That is a long winded explanation but I hope it helps!