The most probable, and easiest way, would be for Chinese agents with physical access to Google servers to insert physical wiretaps. A modified version of a Cisco switch with an extra optic fiber leading off to the police would be easy to hide.  It would be reasonable to assume that Google does not encrypt traffic sent between machines in the same subnet (i.e. in the same physical cabinet).

Once you can wiretap, you can eventually figure out how to distinguish
Gmail traffic from other traffic, and reverse engineer how Gmail data
is replicated across servers.

There is no defense against a hostile party with full physical access to your server room. That is why Google’s only logical option is to withdraw all physical servers from China.