This theme appears to be attempting to load Google fonts from http://fonts.gstatic.com/ rather than from a secure source.

Unfortunately, this makes the theme unsuitable for SSL use.

Any pointers as to where I can find the hard coded http and add an 's' to it?

You could search for the CSS that refers to that font inside the 'themes/themeName/assets' directory.

Perhaps there is a vendor dir too where you may find a reference to the font.

But if it is based on LESS or SASS, changing the source files of those does not change the CSS by itself. If you only change the CSS, it may be written over after an update of the theme.

Yup, it was the import in the css. I feel foolish for not looking there first!