I know I'm not in the area nor a recognized authority on the subject, but I support the idea that the tower you're not hearing the encrypted comms on is simply not capable (or configured) to support encryption. You wouldn't get into a situation where you would hear only one side of a conversation on a given tower, just because only that user is affiliated to that tower. By nature of the way Smartzone works, and trunking in general, you'd have to have "both sides of the conversation" on all towers with affiliated radios.
The most likely situation is that the conversation is actually taking place on Guelph West, and either Guelph Main is configured to broadcast that talkgroup regardless of whether or not there are any radios affiliated to that group on the tower (which is a configuration option), or there is a radio affiliated to that TG sitting on Guelph Main.
Having said that, I suppose that the in-the-clear user could be on Guelph Main, and that's the reason the TG is carried there. However, the ultimate answer to why you're not hearing the encrypted traffic on Main is, as Mike said, because that tower is most likely not set up to carry it.
Smartzone trunking is a unique beast with some configuration options which defy what many scanner listeners "know" about trunking. You can say that some towers broadcast all talkgroups, or you can say that a tower will only broadcast a given TG when a radio on that tower is affiliated. You can also say that talkgroups ONLY function on a specific tower (or multiple specific towers). We have this last one in our system so that if/when the hardline links between towers fail, communications will be forced to function on the main site or a designated backup site. And, as Mike said, talkgroups CAN be set to automatically encrypt all transmissions, but in most cases, like on Fleetnet and on the system I work on, radio users can turn encryption on or off at will. Also as Mike said, a user who is ABLE to run encryption but chooses NOT to, will hear the conversation on his radio in exactly the same way as his encrypted colleague will. Only looking at the radio to see the encrypt switch is in the wrong position - or, listening on a scanner - will he learn of his error.
As for the question of repeaters, again, Mike has it right. All trunking systems use repeaters. On 800MHz systems, the splits are 45MHz down ... meaning that if I'm listening to a conversation on 866.5625, the user is transmitting on 821.5625 into the repeater/trunk site. On VHF systems like Fleetnet, I don't know if there's any hard and fast rule on splits, as there aren't (as far as I know) any default splits for VHF conventional either. Every channel you listen to on a trunk system - even the control channel - has an input frequency. On a Smartzone system where the person transmitting into the system might be on another tower site, the input for whatever frequency's being used on this tower will be silent for the moment.