The SecureLinkFixer extension is looking up every non-https external linked url to be part of a list. This begins with the subdomain and if not found include also the higher level for the same domain.
To remove one level of sub domain from the url a preg_replace with non-greedy regex is used, which can be slow due to some extra work for non-greedy regex internally.
It is faster to replace the regex '/(.*?)\./' with a strpos lookup and use substr for the next substring