From the design:

Find commands are always parsed on mongos. After the user's find command has been parsed into a CanonicalQuery in ClusterFindCmd::run() and we've determined that there may be FLE2 rewrites to be done, and we are inside of a transaction, rewriteQueryOnEncryptedFields() will be called before ClusterFind::runQuery(). rewriteQueryOnEncryptedFields() will make queries to the encrypted state collections in order to rewrite the MatchExpression query before passing it on to ClusterFind::runQuery() as normal.