When there's a proxy between client and Piwik and ssl is handled by the proxy, Piwik serves all images via http instead of https (because there's no secure connection between proxy and Piwik). Piwik currently uses piwikUrl entry from piwik_option table to generate image URL. Even when Piwik is accessed via https, this entry is set to the http version. It's not even possible to hardcode the URL there because Piwik updates this record on each request.

The solution here would be to let the browser decide which protocol should be used. So instead of hardcoding the protocol, Piwik should use // on the frontend side.