Found a lot of sources describing callPackage and some of its internals, but none that refers to it's location. It's like the best kept secret of Nix, and the manuals even seem to be actively avoiding the topic. I could find it given time, but it's a huge repo.
Resources:
- How does Nix's “callPackage” call functions defined without an ellipsis? (Stackoverlow)
- Nix Pills, Chapter 13. Callpackage Design Pattern Nix
The answer actually points to callPackageWith function in customisation.nix, but callPackage itself is defined elsewhere.