The source is not specified in the standard, making it implementation-dependent.
According to RFC 5246 § 188.8.131.52 for TLS 1.2, randomness is only described as:
28 bytes generated by a secure random number generator.
This means it will be entirely implementation-dependent. Any function that produces secure random data can be used. For many modern browsers, the implementation involves requesting a random seed from the operating system (for example, using
/dev/urandom on Linux), and then using that to power an in-process cryptographically secure random number generator.
What actually constitutes "secure random numbers" is specified in BCP 106, a document that provides advice for generating random numbers, the source of the random numbers, how to test the random numbers, etc. This is meant merely as a declaration of best practices and is not mandatory. However, common operating systems tend to follow these practices when collecting random numbers that are exported to userspace applications, such as web browsers.