Visit(CustomAttribute) calls Visit(customAttribute.Constructor) which ends up calling Visit(methodReference.ContainingType) which is the the Visit(ITypeReference) overload.
If you could construct a test case that demonstrates a behavior that you find surprising, it will be easier for me to say something useful or to do something about it. Note that you can change the behavior of the mutator in almost abitrary ways by
overridding methods, such as Visit(CustomAttribute).
There is no Visit(ICustomAttribute) because it is less likely to be needed than Visit(ITypeReference). You can, however, introduce one in your derived class and then override Visit(List<ICustomAttribute>) to call Visit(ICustomAttribute).
Finally, if this mutator does not work for you, you can always write your own one and share that with the rest of us. :-)