The best and safest time to check players and kick them is during OnListPlayers or OnPunkbusterPlayerInfo. If a player is on the player list then they can be kicked more reliably since they are fully authenticated but sometimes it can be a bit too early. OnPunkbusterPlayerInfo happens when their map is fully loaded and are assigned a team and is most reliable but usually happens after OnListPlayers (depends how often your layer is set to fire this event). You could also combine a few events like the following:
Create a blank list of "to-do" kicks on plugin load
Check your API with player info either OnJoin(earliest) or OnAuthenticated and add banned players to to-do list
Check either OnListPlayers(possibly earliest) or OnPunkbusterPlayerInfo(100% reliable) against to-do list
Kick player and remove from to-do list
That's not currently how I have my plugin, but will do something similar in the future to avoid waiting on API calls to kick.