Technically, they can be anywhere in the network. But a lot depends on the attacker, their capabilities, and their goals.
Some of the easiest Person In The Middle (PITM) attacks can be done with a fake WiFi hotspot, such as at a coffee shop or airport. These usually require physical proximity to the victim. They are good if an attacker wants to target a specific victim, and doesn’t have the resources for a more advanced attack. They are also effective at pulling in a few random victims. But they generally don’t scale well, and they expose the attackers to the risk of getting caught.
An attack can be launched against a single computer or browser by reconfiguring it to use the attacker’s proxy. This can be persistent, surviving reboots, VPNs, and relocated portable devices. But it requires some kind of access to the victim’s device to change its settings.
Attackers have been known to subvert Tor exit nodes to intercept traffic. It is claimed that law enforcement agencies have used this technique to target criminals on the dark web.
The most sophisticated attacks that have been published have come from national cyberwarfare organizations. These use attacks such as network-infrastructure-located servers that hijack the SYN/ACK TCP handshake with a more rapid reply than the legitimate server (google for FOXACID for a better description.)