At the bottom of the HTML for https://doc.wikimedia.org/mediawiki-core/master/js/ there is:
<script type="text/javascript"> (function(){ var protocol = (document.location.protocol === "https:") ? "https:" : "http:"; document.write("<link href='"+protocol+"//fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css' />"); })(); </script>
This is correctly blocked by the CSP, but should still be removed.