You appear to be lazy-loading responsive images, so whether the insecure images load (or rather “blocked”) is dependent on screen size. You have many data-srcset attributes that reference http:// – these also appear to reference your non-canonical “domain apex” (ie. example.com), as opposed to the canonical hostname with a www subdomain (ie. www.example.com), so these will also get an undesirable redirect to www if used.
If I resize the browser window in Google Chrome, with the “console” open, you can see the the number of blocked “insecure” images increasing.
You also have an http:// link in your banner which gets redirected, but it gets redirected twice since it is also missing the trailing slash (present on your other URLs).
Added to
.htaccessrule to overwrite all non-HTTPS requests to HTTPS (this alone should be enough?)
The HTTP to HTTPS redirect only occurs after the client has already made the insecure (http) connection to your server, so this does nothing to alleviate the “mixed content” problem.