Hm, this seems to work incorrectly. The login website of https://www.personio.de/login/ after you specify a company to login for does load Google Fonts and those do not show up in the results as violation or at all.
Yes. It doesn’t pick up everything. I’m just parsing the dom and checking for apparent things like script tags etc. I could have used puppeteer or similar to check all requests made, but the user experience became very slow, so I skipped that.