Drupal - How do I remove the itok token from the image URLs?

While it's recommended to keep the itok parameter, it is configurable.

You can suppress it from output using the image.settings config setting suppress_itok_output

  // The token query is added even if the
  // 'image.settings:allow_insecure_derivatives' configuration is TRUE, so
  // that the emitted links remain valid if it is changed back to the default
  // FALSE. However, sites which need to prevent the token query from being
  // emitted at all can additionally set the
  // 'image.settings:suppress_itok_output' configuration to TRUE to achieve
  // that (if both are set, the security token will neither be emitted in the
  // image derivative URL nor checked for in
  // \Drupal\image\ImageStyleInterface::deliver()).

https://api.drupal.org/api/drupal/core!modules!image!src!Entity!ImageStyle.php/function/ImageStyle%3A%3AbuildUrl/8.2.x