That's the point of this thread - this behavior appears to be intrinsic within DNN and doesn't appear to be changeable.  I am calling HTTPS and the site is set to https.  If someone knows how to change these insecure calls, please let me know.

This issue is purely an issue with the Xcillion skin that ships with DNN 8.  The skin uses three Google Fonts from the Google CDN (fonts.gstatic.com).  Unfortunately, the URLs for these fonts were all HTTP, hence the problem.  I have submitted a pull request to resolve this issue.  In the meantime, you can fix your local install by doing a global search/replace in the portals/_default/skins/xcillion/skin.css file.  Replace http: with https: and everything should be fine.