If used by one controller, put in controller. If used by multiple controllers, put in models. If has little or no access to the DB or other Web2py global functionality, put in module.
In theory there is a minor performance hit in adding code to models since all models are loaded on every call. But it's generally not something that most projects need to worry about and definitely not something to worry about in the beginning. It's best to keep things simple and focus on building your application functionality.
