// use reluctant regex to match each image tag individually
// https://docs.oracle.com/javase/tutorial/essential/regex/quant.html
Matcher imgMatcher = Pattern.compile( '<img(.+?)>' ).matcher( record.richTextField__c );

// iterate each image tag found
while ( imgMatcher.find() ) {

    // get the image tag html
    String imageTag = imgMatcher.group();
    System.debug( 'imageTag=' + imageTag );

    // get the value of the src attribute
    // the leading space is significant to avoid other attributes like data-cke-saved-src
    String imageURL = imageTag.substringBetween( ' src="', '"' );
    System.debug( 'imageURL=' + imageURL );

    // if url contained parameters they might be html escaped, unescape them
    // or, more conservatively, replace '&' with '&'
    String decodedURL = imageURL.unescapeHtml4();
    System.debug( 'decodedURL=' + decodedURL );

    // note, as of API 34.0 or later, getContent() is considered an http callout
    // so take that into consideration for your unit tests and governor limits
    // https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/apex_System_PageReference_getContent.htm
    PageReference page = new PageReference( decodedURL );
    Blob b = page.getContent();
    System.debug( 'blob=' + b );

    System.debug( 'Enjoy your Blob, save it as a Document, ContentVersion, whatever!' );

    System.debug(''); // I like blank lines in my logs, easier to scan/read =)

}

// This location is an example from my org; will need to be different for your org
String location = 'https://c.na15.content.force.com/servlet/rtaImage?eid=500...';
do {
    HttpRequest req = new HttpRequest();
    req.setEndpoint(location);
    req.setMethod('GET');
    HttpResponse res = new Http().send(req);
    if (res.getStatusCode() == 302) {
        location = res.getHeader('Location');
    } else if (res.getStatusCode() == 200) {
        location = null;
        Blob b = res.getBodyAsBlob();
        // Return the Blob
    } else {
        // Error
    }
} while (location != null);