What IAM policies/permissions or what you would you need to audit the VPC, NAT Gateways, router tables, etc of Production and Dev accounts?

AWS has a managed policy called "AmazonVPCReadOnlyAccess" that allows read-only access to resources around the VPC.
https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonVPCReadOnlyAccess.html
It is better to use this first than to create one from scratch.
If you need to further narrow down the permissions, you can create a custom one.