(EP)ROM is 64 Kbit (8 Kbyte). DRAMs are 256K*1 bit type (although "4256" suggests otherwise 
), so in total 2 Mbit / 256 Kbyte. Guess you already knew this.
There's a set of 4 mapper registers of (in total) 8 bits wide (the 2x LS670). How many of those are used? You'd have to check how many of the data input & outputs are wired up. But anyway that would be maximum 256 blocks, in 4 memory ranges. Potentially mirrored elsewhere - switch blok in a range, block in another range switches as well. But 4 registers to set in any case. Or in theory, perhaps 8 registers, 4 bit wide... Nah, with 256KB RAM & 8 KB blocks, don't think so.
And there's a separate 4 bit register (the LS175). How many of those are used? Again: check how many of the D & Q pins are wired up. Rest of the IC's are simple logic like (N)AND/OR gates, multiplexers and such. Keep in mind it's possible to eg. wire up some NAND gates into a flip-flip (1 bit register).
100% certain: no slot expansion here. My guess: probably there's some address range or I/O port, which can be written to page out the ROM & page a RAM mapper in. Or some (hardware) flag gets set then, and the next memory access pages the ROM out? Debugging the ROM on an emulator leads to a crash because the 'ROM out, RAM mapper in' doesn't happen in that environment. On the real hw: perhaps some helper routine in say, C000-FFFFh area that does this final bit, and jumps to the cartridge that was loaded into the RAM mapper beforehand?
If someone would map out (all) connections between the IC's, it would be easy to produce a schematic & figure out how it works. Checking all connections would be a tedious job though... not to mention error-prone. 
As a shortcut: see how that '175 is clocked, what goes in as data, and how its Q (or /Q) outputs are used.
This extra IC + wires, anyone know whether that's from factory, or user mod? Or what's underneath the piggyback IC?