If Varnish fails to add geolocation headers, or on non-WMF wikis, CentralNotice will fall back to a JSONP request to https://geoiplookup.wikimedia.org/ which sets the window.Geo variable.

That's a needless security risk for users, and as I understand it most browsers will block such a request anyway. We should change the hosted endpoint to serve JSON at https://geoiplookup.wikimedia.org/v2 or something, and fix the CORS, or otherwise debug why fresh installs won't geolocate correctly.