Yes, you can do this. In fact the Incident Detector does this without any special conditions set by you. You can disconnect the "gfincoming" input from your Incident Detector and remove the "Active = true" from the conditions. Instead, configure your synchronization rule to have the "active" status of each geofence driven by a field in the source feature service like in the attached screenshot.
[ATTACH=CONFIG]26575[/ATTACH]
Any geofences that are pulled into GeoEvent Server will be active only if that field in the Feature Service was "true".
If you want to have that feature service populated by your "gfincoming" input, you can create an output that goes to the geofence feature service, and connect the "gfincoming" input to that new output.
That sounds like something you can accomplish. I would suggest that you store the buffers around each road segment as a polygon layer in a feature service, but add an extra field representing the "active" state. Then use the incoming traffic feed to update that active field to turn on/off depending on how heavy the traffic is for the road segment that you used to generate the buffer. Next create a sync rule that pulls in those buffers as geofences. The sync rule should be configured to use the active field in the buffer feature service, which in turn is populated by your live road sensor data. Then feed your incoming vehicle locations to an incident detector that uses those geofences, and it will only generate incidents for vehicles entering "active" (heavy traffic) areas.
Since the buffers don't change their shape, you don't need to change the feature service at all except to turn that active flag on/off.
I guess I could create another geofence sync and follow the same pattern?
For now, that's cleanest way to do it without doing some tricky buffer-nameing in the feature service. But note that creating two sync rules will double the amount of RAM consumed by GeoFences in the GeoEvent Processor. Keep an eye on the RAM consumed by your GeoEvent Processor.
Actually, it might make more sense to populate a field in the buffer feature service that contains a textual description of the traffic levels in the buffer, such as "LIGHT", "MEDIUM", and "HEAVY". Then configure your sync rule to use that field to populate the geofence's 'category'. Now you create two incident processors, one that uses geofences in the "HEAVY" category, and one that uses geofences in the "MEDIUM" category.