Old versions of Safari could get that. I am being an opinionated ass and practicing hostile security paternalism because the safety and bot-filtering benefits outweigh the cost of supporting old clients. I do even stranger things.
Edit: Applied carve-outs for Apple's iCloud private relay proxies. (I think)
If anyone is curious why I have to block CDN's, they permit abusive behavior, abuse of their workers (apps) and other layers of their networks. Maybe in a few decades they will get on it.