I can confirm it only happens when Short GUIDs are set. I wish I had seen your post a month ago! I forgot this thread was here.
I suspect this is caused by the new CloudKit sharing features that have been enabled in iOS 10. The Short GUID's purpose is solely related to these sharing features. If you enable the Short GUID for a record, then CloudKit expects you're going to want to share this record, hence why it looks for the encryptedPublicSharingKey. However, if you have no sharing zones, you probably also don't have an encryptedPublicSharingKey (I'm guessing). I am also guessing sharing relies on push notifications to some degree, so if you don't have that set up properly, then you also might be missing that key. (Just guessing though).
I note that maybe it's because it's in the Default zone, because the Default zone does not have sharing enabled, but yet it still lets you set the Short GUID. Why would something that's not shareable be able to have a Short GUID, which is only used for sharing?
"Sharing is only supported in zones with the CKRecordZoneCapabilitySharing capability. The default zone does not support sharing." (CKRecord.h, l. 204)
I note that the bug doesn't happen with records created in custom zones in the private DB.
Anyway I have filed a bug report with Apple and also put in a tech support request. Apple confirmed to me on Friday that the bug is with the CloudKit server. The Apple dev tech support e-mail said:
Just let you now that the CloudKit engineering confirmed that the issue is a bug on our server side. They are working on having that fixed now. I however don’t know when the fix will be done and deployed.
I went ahead and updated the bug report to let them know it is related to the Short GUID. FYI my bug report number is