They are using the certificate of the second level domain (drivethrurpg.com), but the URL is a third level domain (graphics.drivethrurpg.com), since the URLs are different, the browser is sending the alarm. Since it is a subdomain of the certificated one, there is nothing to worry about, probably.
Bye
Thanee