In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
That's because the public key in DER format (which is a way of expressing X.509 objects as a sequence of bytes) includes more than just the modulus. Specifically, it consists of:
This is a collection of the following objects; that takes up 4 bytes
The first object is an integer (which happens to be the public modulus); the integer itself is 257 bytes (not 256; that's because ASN.1 integers are signed, and so there has to be a leading 00 to make the top bit zero to signify positive), as well as 4 overhead bytes, for a total of 261 bytes
The second object is an integer (which happens to be the public exponent); if you use 65537 as the exponent, this takes up a total of 5 bytes long (including overhead)
4+261+5 gives you a total of 270 bytes, or 540 hexadecimal characters.
This assumes that the encoder uses an RSA public exponent of 65537 (or some other value between 32769 and 8388607, all of which would encode in the same length); 65537 is by far the most common value nowadays, but is not mandated.
Note that this does not count the encoding that says "this is an RSA public key"; that takes up an additional 24 bytes (including overhead). That's generally included in public keys, but apparently you're not counting that part; that would bring the length past the 540 hex characters you see.
The standard explains that: the public key contains not only modulus, but also the exponent (usually short) and the algorithm identifier.