It's ICMP, so any network that doesn't filter ICMP and would allow malformed packets through could be a target. You'd have no idea when something was PXE booting, so you'd have to keep sending the packets and wait.
A bigger question I think is why you'd assign a public IP to a machine for PXE boot rather than booting it from a private IP space then assigning any publics once the OS is booted.
A bigger question I think is why you'd assign a public IP to a machine for PXE boot rather than booting it from a private IP space then assigning any publics once the OS is booted.