I'm looking at the packet flow diagram here:

https://wiki.mikrotik.com/wiki/Manual:Packet_Flow

For the life of me, I can't find anything in there that describes where in that flow packet capture happens. I'm trying to debug a VoIP issue and when capturing on an internal and then an external interface, I'm not seeing replies from the VoIP provider's side. But I'm not sure if my captures on the outside interface are happening before or after any firewall filtering...

Sniffing takes place between the wire (or air) and the firewall. So if you cannot see the packets to come in via the external interface, you can be sure that they really haven't arrived from outside (provided that an overly narrow sniffing filter hasn't prevented them from being shown). When you can see the packets leaving out via the external interface, you can be sure that your firewall has let them out.

A case of its own is IPsec, which shows the decrypted and decapsulated packets on the same interface like the transport ones from which they have been decrypted and decapsulated, and to make life more colorful, the decrypted and decapsulated packets sometims appear in the capture earlier than the matching transport ones. On the other hand, packets to be encrypted by IPsec are not shown at all, only the resulting transport packets are.