In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
That's because the public key in DER format (which is a way of expressing X.509 objects as a sequence of bytes) includes more than just the modulus. Specifically, it consists of:
4+261+5 gives you a total of 270 bytes, or 540 hexadecimal characters.
This assumes that the encoder uses an RSA public exponent of 65537 (or some other value between 32769 and 8388607, all of which would encode in the same length); 65537 is by far the most common value nowadays, but is not mandated.
Note that this does not count the encoding that says "this is an RSA public key"; that takes up an additional 24 bytes (including overhead). That's generally included in public keys, but apparently you're not counting that part; that would bring the length past the 540 hex characters you see.
The standard explains that: the public key contains not only modulus, but also the exponent (usually short) and the algorithm identifier.