Do I require the source code to analyze a customization?

Simply put, no.

SPCAF can analyze your customization's without the source code. The standalone application accepts full trust/sandboxed solutions (.wsp), SharePoint Add-ins, Office Add-ins, SSOM/CSOM Assemblies (.dll), Executables (.exe), PowerShell scripts (.ps1), JavaScript (.js) files and SharePoint Framework packages (.spapp).