Ok, another problem that I missed until moving over to production server (test server only had one level of categories - so until sub-categories where introduced it looked fine.)
Anyway, when view in my browser the images are shown with the https prefix but whynopadlock shows all of these images...