Could you not simplify your large CSP header by using wildcards and moving some of your dependencies to a central place (e.g. host Font Awesome yourself)?
By specifying paths more explicitly, I whitelist less of the domain (and consequently reduce the chances that I'll whitelist something this is user controllable in the domain). I'll usually try to allow down to specific files in CSP if I can.
Hosting font awesome myself costs me money, pointing to cloudflare is free
Edit: check out my site vs. a few others using Google's CSP evaluator – you'll probably find a lot with known CSP bypasses due to their whitelisting.