RTP packets path after SIP session establishled

Hi Experts,
Folks worked on IMS - I have a small query.
As you know, for SIP Registration/Signalling, the SIP signalling will take the path UE–>P-CSCF–>I-CSCF–>S-CSCF.
Once a SIP session is establishled, what is the path taken by RTP packets?

Is it UE–>P-CSCF–>media-gateway or UE–>P-CSCF–>I-CSCF–>S-CSCF–>media gateway?

I am thinking that it is the first one.

Control plane signalling is through scscf, when it comes to user plane scscf is not involved, afaik.

At first, I also thought the same. But when I looked at the IMS architecture, in many diagrams, I see MGW connected to S-CSCF but not P-CSCF. Since P-CSCF is connected to PCRF, it makes more sense to directly route those RTP pkts from P-CSCF to MGW. Then again, P-CSCF can be in visited networks too and other components like I-CSCF, S-CSCF & MGW stay in home network. It might be why the packets are routed to S-CSCF directly from P-CSCF once the session is established while teh P-CSCF continues to take care of policy and charging.
Any thought?

It depends on the way, how your nodes are designed.
It can be from UE → MediaGateway too.
MediaGateway IP cam be sent in the 200 OK response of the INVITE.
All CSCFs are basically SIP signalling nodes.