We have a custom theme component that includes https://www.googletagmanager.com/gtag/js?id=U_XXX… manually. We were using the built-in discourse method before but took it out because we needed to add some additional gtag methods called before the analytics are included.
Maybe that CSP was set when we were using the built-in method and now it doesn’t remove it for some reason?