Is WordPress calling https or is something else at fault?

Dear Forum Member.

I am seeing https links listed in search engines but there are no internal https links whatsoever. I created redirects for page attachments and these images are also http. The host says that there is no active SSL influencing anything. Last weekend the host said there was a server problem with a multiple ddos attempts from a 3rd party, and it just so happend that coincidentally I was installing the WordFence plugin at the same time. Wordfence would not finish the initial security analysis, so I stopped it and deleted that plugin which removed the settings that I entered with it.

The host cleaned up the database and the host had suggested that it might be a plugin causing the problem so to run a process of elimination to find the culprit plugin. However, the host noticed the code below (I have replaced the real domain with domain.co.uk, but you can see that POSSIBLY ..Wordpress is calling https and seems to be linking with the css for some reason possibly? Please can you help as I don’t know what to do or what to try going forward. I will enter part of the code but the code goes on further…

(index):91 Mixed Content: The page at ‘https://domain.co.uk/pink-circle_border-icons-fro-website-horoscopes/’ was loaded over HTTPS, but requested an insecure stylesheet ‘https://fonts.googleapis.com/css?family=Alegreya&subset&ver=4.4.2’. This request has been blocked; the content must be served over HTTPS.
(index):92 Mixed Content: The page at ‘https://domain.co.uk/pink-circle_border-icons-fro-website-horoscopes/’ was loaded over HTTPS, but requested an insecure stylesheet ‘https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%7COswald%3A400%2C300%2C700&subset&ver=4.4.2’. This request has been blocked; the content must be served over HTTPS.
(index):1 Mixed Content: The page at ‘https://domain.co.uk/pink-circle_border-icons-fro-website-horoscopes/’ was loaded over HTTPS, but requested an insecure script ‘https://cdnjs.cloudflare.com/ajax/libs/modernizr/2.6.2/modernizr.min.js?ver=2.6.2’. This request has been blocked; the content must be served over HTTPS.
(index):1 Mixed Content: The page at ‘https://domain.co.uk/pink-circle_border-icons-fro-website-horoscopes/’ was loaded over HTTPS, but requested an insecure script ‘https://cdnjs.cloudflare.com/ajax/libs/respond.js/1.1.0/respond.min.js?ver=1.1.0’. This request has been blocked; the content must be served over HTTPS.
analytics.js:30 Mixed Content: The page at ‘https://domain.co.uk/pink-circle_border-icons-fro-website-horoscopes/’ was loaded over HTTPS, but requested an insecure font ‘https://domain.co.uk/wp-content/themes/ninezeroseven-child/fonts/oswald-regular-webfont.woff2’. This request has been blocked; the content must be served over HTTPS.Kc @ analytics.js:30
analytics.js:30 Mixed Content: The page at ‘https://domain.co.uk/pink-circle_border-icons-fro-website-horoscopes/’ was loaded over HTTPS, but requested an insecure font ‘https://domain.co.uk/wp-content/themes/ninezeroseven-child/fonts/oswald-regular-webfont.woff’. This request has been blocked; the content must be served over HTTPS.Kc @ analytics.js:30

* There are now https links indexed where there shouldn’t be and I already included a https to http rewrite to help matters.

etc
etc

If you can help I’d be very grateful.

Have a great day.