By default, who is allowed to gain root privileges with pkexec?

By default, it's the members of the sudo group, and the root user, by virtue of these files in /etc/polkit/localauthority.conf.d/:

$ tail /etc/polkit-1/localauthority.conf.d/*
==> /etc/polkit-1/localauthority.conf.d/50-localauthority.conf <==
# Configuration file for the PolicyKit Local Authority.
#
# DO NOT EDIT THIS FILE, it will be overwritten on update.
#
# See the pklocalauthority(8) man page for more information
# about configuring the Local Authority.
#

[Configuration]
AdminIdentities=unix-user:0

==> /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf <==
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

The first file grants access to UID 0 (root), and the second to the groups sudo and admin. admin isn't really used on Ubuntu, but sudo is, and it's the group used to grant access to sudo as well.