PXE works within your LAN subnet. If we assume your subnet is 192.168.3.0/24, your RPi is 192.168.3.14 and your PXE server is 192.168.3.200.
Then the way it works is the PXE booting code sends out a broadcast on 192.168.3.255 (broadcast address for 192.168.3.0/24) saying "I'm 192.168.3.14, are you a PXE server".
The PXE server receives that and responds "Hello 192.168.3.14, I am a PXE server at 192.168.3.200".
The boot code then starts a PXE conversation with 192.168.3.200 and everything works as you'd expect. That includes passing details of the TFTP server where the kernel and other files needed for booting the system can be found.
You can see that traffic if you have a promiscous trace (like Wireshark) running on any other station on the 192.168.3.0/24 subnet.
It's a long time since I tried this stuff with a RPi2B running as a PXE and TFTP server and a 3B (with the OTP bit set) booting across the network.
viewtopic.php?t=168678#p1084100