In a nutshell, your scanner works flawless on basic test sites as in:

https://googlesamples.github.io/web-fundamentals/fundamentals/secur...
https://googlesamples.github.io/web-fundamentals/fundamentals/secur...

but when I had a dev intentionally add an http link on an iframe that contains Java Script referencing the non secure link, the scanner did not detect it. Upon further investigation, I examined using Firefox web dev tools (network), and can see the domains that are involved until the spider reaches the url that contains the insecure http link so I was thinking since these domains are not within the scope, that could be causing the scanner to not pick up the vulnerable java-script page. I have attached some screen-shots to give you a better understanding. Additionally I created a custom profile and enabled:

dom_depth_limit: 3 directory_depth_limit: 3 checks:
- mixed_resource no_fingerprinting: true

and kept the rest as the defaults. Thank you in advanced.