By default, the generated avatars used in WordPress come from Gravatar and are based on the commenter’s e-mail address. While this means that users can have a customized avatars that follow them across the web, it does prove to be a privacy risk even for people that don’t sign up for the service. Fortunately, the function that fetches avatars in WordPress is easily overridden with a plugin, so I wrote a very simple one that lets you specify a salt to append to e-mail addresses before they are hashed and submitted to Gravatar.
It comes with a simple settings page that lets you specify the salt value. One feature that would be nice to add is some way to whitelist registered users or let commenters specifically override the filter on their comment(s), but that’s beyond my time commitment right now (so pull requests welcome!).