Hello,
Thank you for posting in Q&A forum.
According to Microsoft's licensing policy, CAL (Customer Access License) is licensed based on each user or device rather than the number of domain controllers. Therefore, regardless of whether the user is creating in the primary domain controller or an additional domain controller, it is necessary to purchase the corresponding CAL license for each user or device.
Hope this answer can help you well.
Best regards,
Jill Zhou