It seems that some theme stuff (like the favicon and the logo and probably unaggregated CSS/JS) is passed as Drupal paths into file_create_url while aggregated CSS and JS is served from public://. So we need to implement file_url_alter and override the getExternalUrl of the DrupalPublicWrapper class