Does NPM encrypt / decrypt locally on in the cloud vault?

by design:   local only encryption
Your data is encrypted and decrypted at the device level. Data stored in your Norton vault is kept secret, even from Norton. Your Norton vault password, and the keys used to encrypt and decrypt data, are never sent to Norton servers, and are never accessible by Norton.  

Norton cannot see your passwords or sensitive data that you store using Norton Password Manager. The vault password you enter is immediately converted into a special numeric key value used to convert your vault data into encrypted formats.

The process of encrypting and decrypting your data is done using the industry-standard encryption technique. The password you enter is never stored or sent anywhere for anyone else to use - it is used only by the Norton Password Manager running on your device.

https://support.norton.com/sp/en/us/home/current/solutions/v5203190 

Only you know your Norton Password Manager vault password.   

6. Norton Password Manager. 
To use Password Manager, you will need to create a vault. The vault requires its own password. We do not store or keep your vault password so if you lose your vault password, we cannot recover it for you. It is your sole responsibility to remember and keep your vault password. You may then use your vault to store your logins, passwords and login URL’s for other sites you access and use.

https://www.nortonlifelock.com/us/en/legal/license-services-agreement/#password