So… my ultimate goal was to integrate my gpsTime ( GitHub - nmaas87/gpsTime: balena enabled GPS NTP timeserver ) project with the RAK5146 - as the RAK5146 got a nice GPS module and even output the PPS signal - but sadly RAK did not manage to output it via the RAK2287/RAK5146 Pi HAT to the Raspberry Pi.
My initial idea was to solder directly to the PCI-E socket - just getting the PPS signal from there. However, the thing I REALLY WOULD NEED in my lab would be a 10-20x binocular/stereomicroscope - because these jobs are too tiny for my 2x magnifying glass. I tried, but failed. So I shelved the idea again. Until today.
In the meantime, I had migrated my LoRaWAN sensors from ThingSpeak to my private InfluxDB/Grafana instance and still had one ESP8266/BME280 combo hanging at my desk that reported to ThingSpeak. I wanted to this combo to be gone - or more than that, replaced by some RPi with belanaSensor. Hm… let me think. I got an RPi 3 just running the udp-packet-forwarder… basically having its i2c interface free… and a lot of cpu cycles and memory left… wait a minute…
I started again with the RPi hat and noticed the unpopulated 9x2 area on the board.
A radio? Maybe meant for some SX-something-something? Hm… Would not make sense…
I pulled out my multimeter, getting the first gnd point measured. Then I saw that some points where connected to i2c. Ok, damn, this is no SX. The 9x2 grid makes no sense, these pads should be for some non-radio function. But,… it got an antenna out so… Let me see. I think this hat is just recycled… What else got RAK in stock? BINGO! - the RAK2247 Pi Hat ( Connect RAK2247 Concentrator module to Raspberry Pi with this Pi HAT – RAKwireless Store ) - with a big fat Ublox MAX-7Q module at the unpopulated spot. Where is the damn manual?! Ah… it matches my findings! ( https://www.u-blox.com/sites/default/files/products/documents/MAX-7_DataSheet_UBX-13004068.pdf )
Could it be that even the 1 PPS output would be linked from this unpopulated area to the 1 PPS port on the PCI-E?! IT IS!
So I got my 3v3, GND and SDA/SCL for my BME280 sensor - and the 1 PPS output already tied to the RAK5146 without the need to solder a fine pitch!

With that, I needed to go through all RPi pins and find one which was not used by the hat. Spoiler: They are nearly all used, except the I2C ID ports and GPIO 4 - so GPIO 4 it is! I soldered the 1 PPS output to the GPIO 4 - which will be used later by my gpsTime project.
Then I added a breakout for 3v3, GND, SDA, SCL
(Some reference stuff RAK2287/RAK5146 Pi HAT Datasheet | RAKwireless Documentation Center / RAK5146 WisLink LPWAN Concentrator Datasheet | RAKwireless Documentation Center )
After that - I put everything together on the wall behind my TV.
Loaded up a new docker-compose binding udp-packet-forwarder (with GPS=0), a gpsTime instance using GPIO4 and balenaSensor with my network mosquitto server. And thats it 
Now I got my RAK5146 working (with fake GPS, because I don’t need it, the PPS output will probably be used on the RAK5146 module as it is hardwired), gpsTime with precise GPS/PPS signal from the RAK5146 M8Q module and balenaSensor taking care of my BME280 - so that now everything is on one neat system.
And well, what shall I say? It works! 
Still have to see about the LoRa multiplexer, but thats something for another weekend or so 