You will want to get the latest Wolvenkit nightly release here:
GitHub - WolvenKit/WolvenKit-nightly-releases: Provides WolvenKit nightly releases.
And then hop on the modding discords if you want to go really deep into this. Its way above my paygrade.
I don't know how much of the following information will be useful to you because I don't understand appearance randomisation at code level, I only sort of vaguely understand the file side of it. But not how the mechanics of it work. Just where to find information related to appearance variations from the perspective of a modder who is mostly focused on materials and material design.
Material instances are embedded in a buffer appended to the mesh (REDEngine .mesh). The .mesh file also contains all the LOD submeshes.
The REDEngine file chain for loading meshes into the game looks like this:
global Entity -> global Appearance -> local Entity -> Mesh/Materials.
You can find global Entities here: \base\characters\entities\
Of particular interest to you will probably be stuff like \base\characters\entities\light_crowd\crowd__city_corpoplaza_ma.ent
You can find global Appearances here: \base\characters\appearances\
Again you are probably interested in the .apps in the \light_crowd\ folder.
You can find cooked Appearances here: \base\cookedappearances\
(more on cookedapps later...)
Local entities are typically found 1 subfolder above the mesh they import. For example, this is the file path to an npc wa (woman average) bolero jacket mesh: \base\characters\garment\citizen_formal\torso\t2_139_jacket__bolero\t2_139_wa_jacket__bolero.mesh
And this is the file path of its local Entity: \base\characters\garment\citizen_formal\torso\t2_139_wa_jacket__bolero.ent
A global Entity (.ent) imports a global Appearance (.app). These app files are huge (double digit megabytes) and consist of arrays of "appearanceDefinitions".
If we use an example such as "corpo_generic_wa.app" this is an appearance file for a group of generic corpo npcs with the wa (woman average) body type. Inside this file there is an appearanceDefinition for "security_lvl1_03", presumably a generic female security guard npc. Inside this array you will find the file path to its associated cookedapp, the file paths to its proxy/shadow mesh and resolved dependencies (mesh/material/animation assets). It has a buffer that contains entity parameter component data - a lot of stuff to do with skinning and animation that I don't understand - geometry hashes, chunk counts etc.
There is a second major type of Appearance called a cooked Appearance (.cookedapp) and they are split up in ways I don't understand. As far as I can tell, they are like bundles of common .app data in 1mb to 4mb files with their resolved dependency assets (mainly material assets and REDEngine material related files) embedded in them. The theory is they are redundant apps split up into smaller parts and structured in a particular way to provide asset streaming relief if you have really slow storage.
The local Entity (.ent) imports meshes, rigs, animgraphs. Entity files are usually tiny (single digit to low double digit kilobytes).
A lot of the information you find in the .ent buffer will look like magic number shit unless you are familiar with .app files. There is a lot more here that I just don't understand so you will almost certainly have to go look at the files yourself and talk to some of the people on the modding discord to get a better sense of how it all fits together. Nim probably knows the most about the file side of things. Numbers the code side of things (and if he doesn't he will know the people who do). Max seems to know a bit about how apps work because he authored AMM and that allows you to swap/ban npc appearances on the fly.