How are CRL implemented?
Each CA has their own revocation list. When your device validates a certificate, it determines what CA was used to sign it, downloads the CRL (whose URL is included in the CA certificate) and checks if the serial number of the certificate is included in it.

Since all certificates have expiration dates, then any certificate in a CRL can be removed from the CRL when it expires. This prevents the CRL from growing forever.

That being said, CRL aren't used anymore by many clients, which now rely on other mechanisms like OCSP stapling.