I have a push topic query that includes a field hidden from most users in the where clause. My observation is that a notification only occurs when the running user has FLS read or write access to the fields in the where clause. I cannot find any documentation to support this observation.
Example: For Push Topic with configuration:
SELECT FirstName,LastName,Id,OwnerId FROM Lead where Send_to_LRS__c = TRUE
And NotifyForFields = Where
And NotifyForOperationCreate = True
A user with Read access to Send_to_LRS__c will trigger a notification when a Lead in inserted with Send_to_LRS__c = True (as set by default field value in field configuration).
A user without Read access to Send_to_LRS__C does not trigger a notification when a Lead is inserted with Send_to_LRS__c = True (again, as set by default field value in field configuration).
This implies that the push topic query executes as the running user and not as the system user the way Apex operates.