hello,
there is no constraint about physical location betwwen network monitor and enforce/endpoint.
communication between network monitor and enforce is encrypted and it is a TCP communication based on a proprietary protocol.
volume of communication will depend on number of incident you will generate, so if you have policies too lrge you may have lot of traffic.
you could upgrade from v12 to v14...you just may need a new server if you want also to upgrade oracle database.
Regards