Typical reasons of the issue could be like that:

there are 3 nodes in the scenario: client browser (A), document/PD4ML server (B), images server (C).

In regular web browsing scenario A establishes a connection to B to download HTML, and after that to C to download the images.
A – B
A – C

In PD4ML scenario A only establishes a connection to B (to get PDF). In order to produce PDF B connects to C itself to load images.
A – B
B – C

As a rule A has all needed routing info and “knows” how to connect to B and to C even if there is a firewall/reverse-proxy in-between.

But very often server (B) does not know how to resolve name of image server (C), especially if the name is defined for outside world like images.corporation.com, but within intranet it is known under a paranoid cryptic name i.e. b3462346x.intranet.corporation.com; or when the C is belong to another net, and due to security policy B has no routing to C.