How TC works

I could find no technical explanation of how CTC works. Is it correct that it wraps a VPN around communication between the end point and Comodo’s own (or contracted) servers, and then connects without VPN between those servers and the target hosts?

Yes, this is correct. The traffic between your PC (or whatever hardware you have) and Comodo server will be encrypted, but unencrypted beyond it. This does not apply to secure protocols though (such as HTTPS, ssh etc.) which are always encrypted by their nature.