your question is not entirely clear. Are you doing the "location lookup" via http instead of https? Or do your visitors come in via http instead of https?
Back to the question: the common method to get the geographic origin of a site visitor is to use some form of database which correlates IP-address ranges with geographies (typical and probably the one with the widest use: GeoIP). This can be wrapped in many forms in any programming language. So the "getCurrentPosition" call is most likely using some form of a IP-to-Location database.
Visitor IP: will always be available and is independent of http / https - so it will not matter whether your site is http or https or both.
getCurrentPosition: if using a local geoIP database, this one wouldn't even need to do a http or https request. It could use a local DB lookup (file based).
If however it does go to a remote service (which it looks like it does), then just use https to avoid the warning. There must be a configurable item that defines the lookup URL - change that to https.