Self-signed certs work for internal infrastructure because you control the full chain of trust. One server issues the "diploma" and the other checks it, but they're both your servers, so the trust is predetermined.

Internal CA is more about expediency than anything else. It's just easier to manage trust between a lot of servers that way than by manually exchanging self-signed certs across all the permutations.