This answer is not PHP specific (I lack experience in object oriented in PHP).
Validation
Validation actually has very vast definition. It can be:
Data validation
This type of validation usually focus on data type, data length, format, etc. Usually corresponded to database schema. This kind of validation is safe to be put at domain model and can be put at service layer.
Business Rule Validation
This type of validation follows the business rules. It is usually validates some business rules such as the total amount must not below zero, age must not minus, etc. This is better to be put at service layer. Simply because an object can be in different state and has different validation, for example you may has empty title when the article is in draft state, but not when in published state.
Isnull / IsRequired Validation
Beware of isnull / isrequired validation. It can be both data validation (such as an employee must not has null ID whatever it is, etc), or business rule validation (such as an employee must has one supervisor). If it is following the business rule, you must put it in service layer because the state validation I explained before.
Which layer is responsible for object creation?
All layer can do object creation. You just need to make sure that all process are accessing the service layer first before going to data access. If a specific object has a little complex logic to create (such as a car need engine, wheel, gear, brakes, etc), than a builder pattern may meets your need.