There are two* possible places.

The one you may have overlooked is in the moodle config.php file, where you set $CFG->wwwroot

Moodle insists on redirecting to its known wwwroot if that's not how you accessed it.

The other one* is in the apache sites-enabled config.

The confusion is likely to happen if these two don't match somehow - i.e. your moodle config.php specifies http://yoursite and your apache config has a redirect from http://yoursite back to https://yoursite

(*) because we all know that with .htaccess files apache config is never in only one place .....