When WAS boots, when a change is made, and potentially when an app pool is started.
By default, the configuration is read by WAS (Windows Process Activation Service) whenever either it starts, or a change to Applicationhost.config is detected.
It then cuts that configuration up into individual appPoolName.config files, secured for the individual App Pool Identity that needs to read them (you can find these in inetpub\temp\appPools). This always happens on the local disk, regardless of where the root Apphost.config has been redirected to.
If Config Isolation is turned off, that doesn't happen, and I'm not sure what does :)