They're third party. Look at the `src` URL of one. Here's muru's:

    https://www.gravatar.com/avatar/0ce9def9898b5e9e0339ccc26c57ae94?s=48&d=identicon&r=PG

The jumble there is an MD5 hash of the user's email (failing back to network ID if no email set).