Correct. You should only be using the non-secure domain on http sites, and the secure domain on https. Here's a real life example: go to adobe.com and open the debugger. Notice that we're just using standard http protocol there, and the tracking server in the image request is stats.adobe.com.
Now go to https://helpx.adobe.com/photoshop.html and open the debugger. We have several different image requests going to different report suites, but they are all pointing to sstats.adobe.com. Note the secure protocol on this domain. There's only one image request per report suite.
If you're seeing multiple image requests on a single page going to the same report suite, you're likely double counting metrics. I'd recommend double checking your implementation and make sure there aren't any hardcoded image requests, that you're using the s.t() function only once, and that s.trackingServer isn't modified anywhere in your implementation other than its instantiation..