The person initiating a transaction to start a transaction provides one or more UTxO from their wallet, but where does the script UTxO come from? Does the initiating participant provide a script address for the contract in their wallet and the PAB forges a new UTxO for the transaction? How exactly does that work?
When we think about someone interacting with a script they are either sending a UTXO to the script or spending a UTXO that currently resides at at the script.
I will try to clarify what I think you're not understanding using a DEX as an example: I (the buyer) can create an order on MuesliSwap saying I want to buy a certain token for X ADA by sending a UTXO (that is usually "from my wallet") containing specific data to the MuesliSwap script. Now, that UTXO is locked at the script address. Another user (the seller) can then spend this UTXO that is at the MuesliSwap script address if their transaction meets the requirements that the MuesliSwap contract code enforces, which in this case would be that the buyer receives the token (the seller includes a UTXO containing the token as another input in addition to the UTXO at the script) and sending the seller the X ADA that is locked in the UTXO the buyer sent to the script.
Multiple of these "buyer order UTXOs" can reside at the script address and would impose different requirements on the script validation depending on the data inside them (buyer wants token XYZ for 123 ADA). A seller can choose which UTXO at the script address they wish to spend to in order to complete a trade.
This example shows that sometimes you are spending a UTXO from your wallet to lock it at a script, and other times you are spending a UTXO that someone has sent to the script instead of one from your wallet, depending on the context and what you are trying to do. So when you ask "where does the script UTXO from?", in the example above it would be the UTXO the buyer sent to the script, if I am understanding your question correctly.
Think of the script address as a mailbox with a lock. Anyone can view and deposit assets into the mailbox (just like any other address on chain). Unlike any other address however, unlocking the funds requires more than just a private key signature.
Rather, it requires that any transaction using a UTXO residing at the script address as an input evaluates to the same script hash specified by the script address. In other words, the only way to spend from a script address is to supply proof (in the form of matching script hashes) that the transaction logic is identical to what was outlined by the creator of the script address.
When spending from a script address, you would reference the desired UTXO input via its Tx-id, just like any other UTXO input.