It might be worth enabling the discourse connect overrides avatar setting, logging out of Discourse, then logging back in again. I’m fairly sure it’s expected that the avatar can be updated without that setting enabled as long as the avatar_force_update parameter is set to true in the SSO payload. The code that handles this is kind of complex though: discourse/app/models/discourse_connect.rb at 2ff3f44b957268718e03554fb25d485e1d449ed5 · discourse/discourse · GitHub.
If you can’t enable that setting, or are just curious about what’s going on, another thing to check is to make sure that the value you’re passing for the avatar_force_update parameter is being interpreted as the boolean true by Discourse. There are frameworks (notably WordPress) where boolean values get converted to 0 or 1. To work around that issue, Discourse will accept the string "true" as a boolean value in the SSO payload. You can probably confirm this by looking at the value of the avatar_force_update field in the SSO record that’s displayed on the user’s admin page. Or by enabling the verbose logging setting that Jay mentioned.