Anybody knows why portainer can check if some images hosted on ghcr.io are out of date but not others?

Because you're being rate limited. Don't let these tools constantly hammer Github's API in mass fits and starts or you may get a back off from GH.

What does the log say?

Just a wild guess, but maybe it got rate limited by GitHub?

Also manually verify your access tokens, even with PATs their interface is really janky and some repos might have weird permissions.

I think it has to do with whether or not the image contains enough metadata for a scan to take place and thus it doesn't know the status of said image. I'm going out on a limb, but this would be something the dev team should have included in his manifest or what ever(?). I'm not a Docker programmer. I think I read that somewhere else. Give corrections if any.