Where should RemoteEvents be located?

You don't have to -- it's almost solely a matter of organization. You probably won't want any RemoteEvents in ServerStorage, since then client scripts won't be able to access it, but otherwise it's up to you.

You should come up with a system that makes sense and will be easy to use. If you put a RemoteEvent in, say, workspace.Part, that's going to be very difficult a script to access unless it's a direct child of the RemoteEvent. In contrast, putting all RemoteEvents in various Folders in ReplicatedStorage could be an easy-to-use system (and if you don't have that many RemoteEvents, you don't even need folders).

Because the contents of ReplicatedStorage can be accessed by any client and the server.

From the wiki:

In order for both the server and clients to utilize RemoteEvents, the RemoteEvent object itself must be in a place where both can see it. It is recommended to store RemoteEvents in a folder inside of ReplicatedStorage, although in some cases it is appropriate to store events in the Workspace or in Tools.