bankbank, Most stuff makes it into vram via dma, from both the sh2 cpu and the cps3 board also has another dma controller to do palette, sprite and character dma.
To get the addresses from where this stuff is coming from, you'd need to edit the driver and uncomment all of the logging in the dma (chr,pal,sprite) functions, as well as in the sh2 cpu's dma function - as the logging stuff is there but commented out. One could also watch the dma addresses without recompiling anything. Look for dma_w in cps3_map in the current mame driver.
best regards,
- dink