Although I've checked for other modules using hook_node_access, I forgot to check for hook_entity_access as well. It turned out that the "content moderation" module is denying access. Thanks @4k4 for making me revisit this!
Just for the record, if you need to see whatwhich other modules are using a certain hook, you can use something like this:
function mymodule_module_implements_alter(&$implementations, $hook) {
if($hook == 'node_access') {
//do whatever you need to do (e.g. use kint($implementations) to see what other modules are using this hook)
}
}