Is a ReplicaSet pulling a fresh image at every spin up?
my understanding is that I'll probably need to modify the images pulled to do this.


Yes and no. It depends on how your ReplicaSet - specifically the associated Deployment - is configured. You can see the corresponding YAML configuration by doing 

kubectl -n yournamespace get deployment yourappdeployment -o yaml
# or 
kubectl -n yournamespace describe deployment yourappdeployment


Which will give you information about environment variables, images used, volumes, secrets, etc. 


  I am trying to pull the images down locally so I can modify them


Pulling an image down and modify it in-place won't be of much help, except if you run a container based on this image and use something like docker commit yo actually update the image. Even if you do that, the Kubernetes objects may override aspects defined in your image (such as environment variables)


  is there a way to see how the ReplicaSet is pulling the images down?


Yes, first output the details of your ReplicaSet:

$ kubectl -n yournamespace get replicaset yourreplicaset -o yaml

kind: ReplicaSet
spec:
  ...
  template:
    ...
    spec:
      ...
      containers:
        ...
      imagePullSecrets:
      - name: some-secret-name


imagePullSecrets is the secret which should contains the credentials to pull your images. You can retrieve the data with:

$ kubectl -n yournamespace get secret some-secret-name -o yaml

kind: Secret
...
data:
  .dockerconfigjson: eyJh...VeryLongBase64String


This is Docker authentication data encoded in Base64. You must decode them:

$ echo "eyJh...VeryLongBase64String" | base64 -d

{"auths": {"registry.yourcompany.com": {"auth": "AnotherBase64EncodedString"}}}


Decode the auth value and you'll have your Docker registry login/password

$ echo "AnotherBase64EncodedString" | base64 -d

username:password