Looking at
and
it appears to just load all modules in module-list.nix so any module that adds to environment.systemPackages would be suspect. Mainly this one:
module-list.nix
environment.systemPackages