Those are mixed content warnings. It happens because some remote avatars use HTTP instead of HTTPS. While the site itself is fully HTTPS those avatars are loaded with HTTP triggering those warnings.
The solution is to disallow remote avatars or force them over HTTPS.
I’ll get on it.