In all the external check documentation, the documentation tells us, that they are executed on the zabbix server.

This is however not true for the case when a proxy is in between, then the external checks are executed by the proxy.

This should be mentioned in the external check page of the documentation.

https://www.zabbix.com/documentation/3.4/manual/config/items/itemtypes/external