There is no single answer, as it must be determined according to your priorities. On one hand, performing a penetration test in the pre-production environment is interesting because it is very similar to the final environment, and the tests will not affect the services used by your users/customers. On the other hand, conducting a penetration test in the production environment has the advantage of being done under the real conditions of use of your product, with the latest developments implemented.