That is weird, the sandbox is running latest Discourse with nothing special.
If it is happening with client side compression disabled and / or with a 8kB PNG then the problem is elsewhere I’m afraid.
Not much we can do without either access to the instance and to a device that can reproduce or detailed logs from the web console where it is happening tho.