Calls using 3CX are SIP-based. If your provider supports SIP TLS/SRTP, you can probably encrypt the feed between the provider and the PBX.
Starting at the 3CX, it depends on what you are using.
- STUN phones : Not encrypted, direct SIP using UDP.
- SBC phones : Not encrypted locally, but the flow between the PBX and the SBC is secured.
- Webclient : encrypted by default, it's WebRTC.
- Mobile Apps : force encrypted, the app only works with the tunnel, which is secured.
- Windows app : depends on your config, you can use SIP TLS + SRTP on that one, or use the tunnel.
Keep in mind that for videocalls, only VP8 is supported on the Windows and mobile apps. The Webclient does support H264, as most SIP endpoints use that.