1. Medical - there are a few Regional Medical Offices (RMO) around the World, including one in Ontario. The physicians at the RMO review the documents and medical exams sent to them by your Panel Physician (previously known as Designated Medical Physician) and make an assessment on your status. This status is then communicated to CIC and matched up with your file.
The photos are to make sure you took your own exam
2. The Security Checks are weird because Mexico is an exception to the rule. You are supposed to send in clearances from every country you've lived in since you turned 18 with your application. In some cases, they also ask for specific state clearances. For Mexico, they used to ask for both federal (PGR) and state clearances (except for DF). You were supposed to send the state ones in with your application (as you did) In contrast, they asked you to wait to send the one from the PGR because the PGR requires an official request from the government requesting it. Therefore, while your application is being processed, if the applicant lives in Mexico, the Canadian Embassy in Mexico City will mail you a request letter (if not, you need to mail them a bunch of docs). You then take this request letter to the PGR, get fingerprinted, and return to get your certificate 10 days later (though they can be faster). The PGR has been empowering several state offices to do these so folks no longer need to go to Mexico City.
The twist to all this is that they recently stopped requesting the state certificates and now request the SSP clearance in lieu of the state clearance (in addition to the PGR). The SSP certificate can be requested only in Mexico City by the applicant or their direct family member (or theoretically through a consulate of Mexico abroad, but reports are that consulates aren't necessarily aware of this). You do not need anything from the Embassy to request this 'certificado de no antecedentes penales' so you could get it anytime.
Police certificates are supposed to be submitted to CIC within 3 months of them being issued and technically expire one year after being issued. In reality, they don't always ask for them to be redone after a year but they can do so.
