Separation of concerns for a API or Service accepting query filters

I always had this confusion which I couldn't reason more. Every time I think about it I go confused.

It is also hard to put in one line that's why the title is ambiguous.

All it is about where logic should go?

I have structured my backend architecture as below.

Router routes to controller and controller communicate with a Service Provider or Service.

i.e

For /zones router will route to ZoneController which loads off tasks to ZoneService .

Likewise, /banner-images router will route to BannerImageController which loads off tasks to BannerImageService

Fair enough!

Now, suppose I need to fetch banner images at a zone so banner-images?zone_id=2

Where the logic should go? Which controller? Which Service?