An App Engine Standard app in a project already connected to on-prem via Cloud VPN must access an on-prem database. What configuration enables App Engine Standard to reach the on-prem network?

Serverless VPC Access is the correct solution. It allows serverless environments like App Engine Standard to connect to resources within a Virtual Private Cloud (VPC) network. Since the project is already connected to on-premises via Cloud VPN, traffic from App Engine Standard can flow through the configured Serverless VPC Access connector into the VPC, and then over the VPN tunnel to the on-premises database. Private Google Access is for on-premises hosts to reach Google APIs privately, or for VMs in a VPC to reach Google APIs without external IP addresses. It doesn't facilitate serverless services reaching on-premises resources. Private Services Access is used for connecting your VPC to Google-managed services (like Cloud SQL or Memorystore) within a Google-managed VPC, not for connecting serverless services to your own VPC or on-premises networks.