The router's mac address is actually stored in the devinfo partition. It's stored in ASCII, in key-value pairs, which unfortunately the mt76-mt7615 driver cannot use, as it expected binary mac address.
From what I understood of the EEPROM structure for the Factory partition, it has 6 bytes allocated for mac address, but when I looked at the partition, it contains Mediatek's mac addresses. In any case, I think the Linksys firmware changes the WiFi interfaces' mac-address (obtained from the devinfo partition and incremented accordingly) after the driver has loaded and during interface bring up.
I do not know much about WiFi interface calibration data to comment on whether Linksys is using non-standard ones, but I doubt it. Most likely they just take whatever Mediatek sends their way.