Actually isn’t that big risk, if at all. CSP is very unreliable way, and security will fall anyway because there is quite big must to allow everything, if one want keep things in work.
But for you that is quite easy dilemma: do you really need that extra layer of security or do you need google tags? Or can you use Matomo instead?