Gmail (particularly its organisational twin, G-Suite) is picky when it comes to its SMTP relays, specifically when it comes to using the LOGIN commands as opposed to XOAUTH2. A quick Google of the error message returns a plethora of users with the identical issue, many of them using PHPMailer.
Essentially, it thinks the connection is suspicious. And, they're probably not wrong. VPS + PHPMailer don't make for a great combination spam-detection wise. I'd flag it too.
According to the unlock page (which I just checked), you should do the unlock and then immediately attempt to authenticate.
I don't really consider Gmail, even G-Suite, a good tool for transactional mail. It's not really intended for it. At best, the G-Suite SMTP relay is a feature implemented so that universities and companies could keep their photocopiers emailing scans to staff after an Exchange migration...
Options:
1. Create another application-specific password, try the unlock again and immediately attempt to authenticate with correct settings (use TLS on port 587).
2. Use IP based authentication in G-Suite settings and supply your VPS' IP address.
3. Look into a better transactional email provider (such as Amazon SES or Sendgrid), or, run your own email server for notification emails.