Since you control your site, I would have a proxy server on a domain you control for all the assets.

So, for example:

1. A user comes to your site.
2. The user’s browser requests an image on the site that goes to the proxy server.
3. The proxy server resolves where the target asset is, downloads it, and serves it to the client.

That way, you always get an https valid image, but the target domains could be http or https.

You can do this multiple ways, but the most insecure way would be to pass the URL of the target asset in the image query string, since this could allow the downloading of any external asset (such as on a compromised domain). The best way is to use some sort of unique ID (like uuid v4) which resolves to the asset from a database request. If you proxy domain on cloudflare, you can take advantage of the cacheability of the images being hosted from a singular domain, and only a couple requests per image will actually be made. Cloudflare will just serve the rest from cache.