listCollections executed by the ImplicitEncryptedDbClient can rarely end-up executing on a secondary that hasn't replicated the collection yet, causing the client from missing the required information for encrypting. 
The commands runs with kPrimaryPreferred which will route against a primary if known by the RSM. 
If unknown, this will route against a secondary.

While this is a transient issue from the router which self-fix itself and is not necessarily a problem, secondaries might not have replicated the new collections yet. 

We could try to use kPrimaryOnlyReadPreference to enforce the routing against a primary. This should cause the router to wait until a primary is known