Get current path in hook_file_download
That's the correct behaviour.

If current_path() wasn't the URL of the file, then the file must never have been requested, and that hook would never have fired.

When you request a private file the current URL must be the file's URL, by definition. It sounds like you're looking to track the page that originally contained a link to your file. That's going to be almost impossible to do reliably.