Does this need passthrough or might we be able to leverage PVM with it on a passthrough-less cloud VM/VPS?

I am not sure exactly what you are asking but firecracker does need access to /dev/kvm so nesting needs to be enabled on the VM.