Found a lot of sources describing callPackage and some of its internals, but none that refers to it's location. It's like the best kept secret of Nix, and the manuals even seem to be actively avoiding the topic. I could find it given time, but it's a huge repo.
Resources:
The answer actually points to callPackageWith function in customisation.nix, but callPackage itself is defined elsewhere.
Despite the lambda output from the other answer, I believe the original value of callPackage is actually defined inside of pkgs/top-level/splice.nix, link here
The reason the path in the lambda doesn't return that^ position is because nixpkgs does some absolutely insane recurisve computation. My understanding is that pkgs is replaced over and over (bootstrapped), and the attributes on pkgs (like callPackages) are replaced multiple times. If you're familiar with fixed point combinators in mathematics, like the Y-Combinator, that is effectively what Nixpkgs is applying until the pkgs stablizes. So pkgs.callPackage is actually some random/dynamic function-argument instead of an attribute that is set directly. And that dynamic function argument is what the lambda-path refers to.
It's like the best kept secret of Nix
I've been reading the source code for 3 years, and it took me at least 5 hours of chopping up a minimized version of nixpkgs (which was a project on its own) in order to figure out that callPackage was actually coming from pkgs/top-level/splice.nix. And finding where it is defined isn't even half the battle for really understanding where it's coming from. So yeah, I'd say its a pretty well kept secret and might still be a secret after this answer since I can still barely claim to understand it myself.