Sorry, I’m not that familiar with CPM to answer that; all I know is that file(GET_RUNTIME_DEPENDENCIES) explicitly excludes build-local files as they are intended to be installed via install()[1]. Personally I’d prefer find_package for dependency management given what I see here as it clearly separates your code from external code, but it does mean using a separate dependency management tool. Something like Conan, vcpkg, Anaconda, Spack, custom superbuild, linux distro, HomeBrew, ports, Nix, etc.
[1] The main reason is that CMake’s export logic is going to assume the targets will also be exported.