The picture claim would imply that scope profile was requested and then granted as part of the login transaction. Do you obtain other claims that are associated with the profile scope like name and updated_at?
If you do:
api.idToken.setCustomClaim('x_custom_picture', {{basically anything}});
api.idToken.setCustomClaim('https://claims.example.com/picture', {{basically anything}});
do you see any or both the claims above returned?