Interesting. We inline a base64 image in there. I wonder why we didn’t just link to the external resource in the image svg tag 
I dived into the history of the plugin all the way til where we first added this:
https://github.com/discourse/discourse-narrative-bot/commit/142d75f501b95675a71023ec7b8a115b15972bc7
And looks like we always used base64 inlined avatars.
EDIT: After some research, we inline with base64 because the certificate is loaded via a img HTML tag. To get cheaper avatars we would have to move to a object tag, which is default blocked in our CSP. Or inline the entire SVG in the post content. I guess an iframe is our best shot.
I have FIX: Make discobot certificate gen faster/non blocking by xfalcox · Pull Request #11344 · discourse/discourse · GitHub for @tgxworld comments.