Content Security Policy Incompatible with Some Pages
Content Security Policy does not work with pages that carry Google AdSense advertisements or Google Analytics code. Google apparently refuses to support either service if CSP is on the page, even if the CSP is set to the most permissive settings. While you may still receive site-wide Google Analytics data, you probably won’t receive per-page data or any Google AdSense ads.
I don’t know if other suppliers of advertising or analytics data are also uncooperative with CSP.
You may have to comment CSP out completely or delete it altogether.
I have no good suggestions for using CSP. You may have to live without CSP, at least for now. If you’d like to look more into it, try these: