How can we modify field permissions for the CustomObject__ChangeEvent fields via profile / permission sets? Is it possible?
It is driven from the FLS of the User on the object changing. See Change Data Capture Developer Guide - Field-Level Security.
Change Data Capture respects your org’s field-level security settings. Delivered events contain only the fields that a subscribed user is allowed to view. Before delivering a change event for an object, the subscribed user’s field permissions are checked. If a subscribed user has no access to a field, the field isn’t included in the change event message that the subscriber receives.