The old version of kloak basically captured all input devices, and then made new input devices that the rest of the system could read from. This worked without a GUI and made things more-or-less transparent to the rest of the system, but it also made it impossible to anonymize mouse input events correctly. See:
The new version of kloak captures input devices, and then passes them directly to the display server via emulated input. This allows much tighter integration with the display server, which allows us to anonymize mouse input properly. Consequently, kloak can only work once a display server is running, so it needs to run After=graphical.target.
It shouldn’t. and it looks like in the source code it doesn’t:
If you still have a Before=multi-user.target dependency for some reason, that should be removed. (Note that WantedBy=multi-user.target is expected and is fine; that means that starting multi-user.target will try to start kloak.service, but kloak.service will wait until graphical.target comes up to actually start. We could probably change that to WantedBy=graphical.target safely, but the existing mechanism should work.)