Probably the SPI is set to RX-only mode.
In this mode it'll send clocks non-stop for best efficiency, so you don't need to clear flags for the next transfer to start, when you read DR register the next byte is already being clocked in.
The downside of this mode is this, it'll always send extra clocks until the code stops the peripheral.
Try:
HAL_SPI_TransmitReceive(MAX31855->hspi, payload, payload, 4, 1000); // receive four bytes from MAX31855
This code is slower, will send whatever it's in your payload buffer and overwrite it with the received data, but controls every byte/clock accurately.
You don't need to setup MOSI pin, the sent data goes nowhere.
If you're using MOSI for other SPI devices, no problem either, they'll be inhibited.