It has nothing to do with approval. This specific ruling is about the principle of data minimisation. If you process personal data you must do a risk assessment

It has nothing to do with approval. This specific ruling is about the principle of data minimisation. If you process personal data you must do a risk assessment and make sure you only process no more data then strictly necessary. This applies even if you have consent. So in this case since you can host the fonts yourself to not share data (IP, time, browser agent, cookies) with Google you should.