According to a the technet articles:
The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform certificate enrollment by using the HTTPS protocol. Together with the Certificate Enrollment Policy Web Service, this enables policy-based certificate enrollment when the client computer is not a member of a domain or when a domain member is not connected to the domain.
And they explain all the steps on how to install these services but not how they're used. Like yes, I want non-domain clients to enroll for certificates, so how do the clients do that? For the CA Web Enrollment service it clearly says to just enter this into your browser:
But for the CE and CEP services it says nothing. Maybe I don't actually understand what they are?