Yep.. the data is sent MOM client to MOM server comms. That's another reason why we require same domain and kerberos authentication between client/server.CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response)
Check out my blog http://blogs.technet.com/kfalde