I don't know for sure what mechanisms Venmo uses specifically, and I suspect that anyone who does is under non-disclosure, but it is common practice for "social" apps to use a number of signals to make correlations to construct your potential social graphs. See, for example, this very recent article on Facebook's "People You May Know":
How Facebook Outs Sex Workers
Location is also a strong signal, and it can come from Location access given to apps (which extends to 3rd-party code running in those apps that can then share or aggregate behind the scenes), or simply coming into proximity of one or more of the same WiFi access points.
If a good correlation can be made to some of your close contacts through some of the available signals, then it's an easy leap to mine their Facebook and other public profiles and graphs to suggest friends of friends (you are likely to know many of these people).
Also in THE INFORMATION WE COLLECT: "Finally, we may collect additional information from or about you in other ways not specifically described here." which means pretty much anything goes. For example, it could include information from data brokers who have aggregated a broad array of data about you and your associations over time.