The time of the first request looks like it is including the DNS and socket connect times - I’ll take a look and make sure it is consistent because requests 4 and 5 should probably be closer to 500ms.
As far as the gap goes, modern browsers can pre-connect to servers before fetching resources but the HAR spec doesn’t allow for the connection or DNS times to be separated from the request (the gap is the accurate representation).