The images are routed through the payload API. _key in the doc used by the plugin to fetch it . View here - github: payload/packages/storage-uploadthing

If you check the logs on uploadthing, you can see the requests coming from your server.

There's a ticket here from 2022 suggesting that there's a way to disable this but I've not found the property in newer versions of storage-uploadthing plugin.