With both force:mdapi:deploy and force:source:deploy, there is a parameter to specify the test level (-l or --testlevel).
Looking through the documentation, it seems like both should be using the "NoTestRun" level (since you're not including apex or triggers) though it is possible that there is a discrepancy between how the mdapi command is run and how the source command is run. This behavior suggests that either:
- The force:mdapi:deploy command is actually running with the "RunLocalTests" test level
- The force:source:deploy command is incorrectly applying a check for the test level when no apex/triggers are being deployed
The metadata api also changed for api >= v34.0. Prior to v34.0, local tests were run when deploying a permissionSet (same with a handful of other metadata types).
There is also a github issue on the sfdc cli project that seems to be almost word for word a match for your issue, which contains a nifty workaround. Simply use the "RunSpecificTests" test level, and provide a test name that does not exist as a test class (it seems like using an Apex class name works, but that's not something I'd suggest doing) in your target org.
Something like sfdx force:source:deploy -m PermissionSet:myPermSetName -u Production -l RunSpecifiedTests -r notATest