Based on the GET and the "Access denied", I would think that it's a problem with your default page.
I have IIS experience but not with Symfony/PHP. Does it honor IIS's default document setting or do you have to define that somewhere else for RouteListener.php to use?
Check the NTFS security permissions on the folder where your default page is. You will need to grant the IIS worker process account read access. Thats the IIS_IUSRS group. If you authenticate the client then you may need to add the Users group for read access.
Trace the call with Process Monitor.
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
Add a filter for "process name is w3wp.exe". Look in the Path column to see if tries to read your default document. Does the Result show SUCCESS or ACCESS DENIED?
You might see "name not found" events as IIS looks for default.htm or default.asp which may not exist. That's normal.
Double click an access denied event and see what user account is referenced.
Look for other access denied events and see if they reference Symfony/PHP configuration files.