Insecure urls for https

Trying to move to https:// and the ssl lock is not green. When I run the site through WhyNoPadlock?, it says the following (using mydomain.com as example here):

Insecure URL: https://mydomain.com/wp-content/uploads/2016/01/apple-icon-precomposed.png

Insecure URL: https://mydomain.com/wp-content/uploads/2016/01/bluedarthosting.png

Insecure URL: https://fonts.googleapis.com/css?family=Lato:300,400,700

I’m trying to find where in the theme (looked in the standard places – header, functions, options) these would be, but not finding it. Must be a hard-coded https:// somewhere in there.