The short answers are "no" and "technically, neither" respectively.
The point of authenticating
The Salesforce CLI tool, when first installed, has no connection to Salesforce whatsoever. You can use some of the functionality of the CLI in this state (you can create a project, make a new apex class, maybe a few other things), but most of the functionality requires the CLI to have a target org to perform the action against.
When you use the CLI to perform an action, that action is originating from your local computer, not Salesforce. To be able to have something outside of your target org perform actions within the target org, you need to authenticate.
When you use
sfdx force:auth:web:login, you are going through one of the OAuth flows to give the CLI permission to make requests to that org on your behalf. This allows you to do things like query records using
sfdx force:data:soql:query, retrieve/deploy metadata to a non-scratch org using
sfdx force:mdapi:retrieve and
From there, the CLI handles setting up the appropriate requests, and using the appropriate (and for the most part, already existing) APIs.
On configuration of scratch orgs
Technically, scratch orgs are not generated from an org, nor from source.
Creating a scratch org requires a dev hub org (and for the CLI to be authorized to make requests to that org), but the scratch org itself is not generated from any data or configuration in the dev hub org.
Salesforce themselves aren't likely to explain why a dev hub is required, but I think that reasonable speculation would be that it's part of preventing everyone in a given company from being able to use features that they haven't paid for (at least, not without a significant maintenance effort).
When you create a new SFDX project, you get a configuration file (/config/project-scratch-def.json) which allows you to control the "shape" of the scratch org (i.e. what features are enabled, a limited selection of Salesforce editions, and more). This file is what actually controls the configuration of your scratch orgs.
This configuration file is technically part of the "source" for your project (it can be managed by your code versioning system), but at the same time it's separate from the "source" of your org...the things like Apex classes, SObject definitions, Lightning components, Validation rules, etc... that actually reside within your org.
When I hear "source", I think of the things that can be moved around to different orgs and your local computer using commands like
sfdx force:mdapi:retrieve, and
At time of writing, your dev hub org, your metadata/source, and the configuration file in your sfdx project all play their own roles in creating a scratch org. They are all necessary (well, you don't need to push any metadata to a scratch org, but you wouldn't be able to do much practical development without pushing metadata).
I think the most accurate answer to your question as worded is that the scratch org is generated from the CLI on your local machine using the scratch org configuration file in your project, and running the
sfdfx force:org:create command requires authentication to a dev hub org for [reasons not disclosed by Salesforce]