How to identify extensions blocked by Gatekeeper
I figured it out.  In System Information > Software > Disabled Software, it shows a list of these extensions with their bundle identifier.  In my case, that was enough info to understand what the app is, but to locate the actual kext file requires more digging.  Example:

grep -r "com.aladdin.kext.aksfridge" /Library/Extensions finds nothing.

grep -r "com.aladdin.kext.aksfridge" /Library/Application Support found it.

I'm not sure if there is a documented list of locations that are allowed to load kexts, but you could grep the whole hard drive for the bundle ID and that would surely find it.