They don't explicitly state what format they run the scanner in, but I would be very surprised if salesforce didn't have their own checkmarx server on their internal network that does the scanning. In other words, it's very likely to be a server under salesforce's control, but running the checkmarx application on it.
If you're really worried about where the code is sent you can ask them, they've responded to me on twitter before via the @SecureCloudDev account, and they also have an office hours program available for Q&A.
Per their help the only rate limits are:
no more than 3 scans per security review and no more than 30,000
lines of code scanned per month
This seems rather odd to me, and is likely unenforced, especially since you can submit scans not related to a specific security review, and there's a previously listed limit of 500k lines of code per org. As you're unable to specify components to be scanned I don't see any logical way to reconcile these points. I've never hit this limit in practice.
Take a look at that help document for other considerations, but there's one I'll add: the larger your codebase the longer it takes to scan, and the effort increases non-linearly: a 20k line scan is much more than twice as fast as a 40k line scan.
If you're undergoing security review I'd kick off a scan now, before you even start the review. No reason not to!