I can’t reproduce this issue in our hosting. Which leads me to think that this is possibly a problem with caching, likely on your server or your CDN, if you are using a CDN.
The route here is marked to be cached for 24 hours, however, some configuration don’t store the query parameters when they cache the request, which would explain why it’s showing the wrong image to the wrong user.
Since I don’t have a repro on our hosting, though, can you test this branch and see if it actually does fix your issue? DEV: Skip caching discobot certificate generation by pmusaraj · Pull Request #37495 · discourse/discourse · GitHub (It’s a one-line change that just removes the caching on this route.)