1. The agent installed on the syslog server will need 1 node license. If you have say 10 routers in a remote location sending logs to central LEM server, it would use 10 node licenses. By using a remote syslog server + an LEM agent on it, we are now talking 11 node licenses, i.e., 1 additional node license for each syslog server
2. It would be 100s:1 if not 1000s:1. Do your own bandwidth testing to see what you get but the point is logs do compress very well
3. Agent normalizes first (with the default connector output type setting "Alert")