This bug is not specific to Keycloak but it is a general issue. According to the OIDC specification, the ID token in a refresh response SHOULD NOT contain a nonce, see https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse.
We observe the same problem with Forgerock as the IdP.

So the issue specifically here is that we are using the same nonce checking on the initial token, and refreshed tokens, and I'm guessing some providers do provide a nonce, and some do not?

If you set insecureSkipNonce this fixes the issue, but also means that the nonce is not being checked for the initial ID token either?

I guess we probably want to skip the check on refresh tokens, per the spec link you added.

Anyone able to look at wrangling up a PR?

Yes, if we set insecureSkipNonce = true, the issue is not present. But then the nonce check is also disabled for the initial ID token.
Based on https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse, I expect the following behavior:

1. insecureSkipNonce = true: Do not validate the nonce, neither in the initial ID token, nor in refreshed ones.
2. insecureSkipNonce = false: Validate the nonce in the initial ID token. Validate the nonce in a refreshed ID token only if the nonce claim is present in the refreshed ID token (if present, the nonce of refreshed ID tokens MUST be the same as the one in the initial ID token).