They generally aren't, as far as I can tell? SRI (no changing content for a specific user) + crossorigin ('The "anonymous" keyword means that there will be no

They generally aren't, as far as I can tell? SRI (no changing content for a specific user) + crossorigin ('The "anonymous" keyword means that there will be no exchange of user credentials via cookies, client-side SSL certificates or HTTP authentication'), no referrers via meta tag or header. The other end gets your IP and browser UA, with nothing else. It is pretty low on the totem pole of worry.