A preconnect is not a hint
The Turnstile module was opening a TLS connection to Cloudflare on every page of this site, including pages with no form on them.
While building this site I checked what it requests on first load. The answer should have been nothing off-origin at all: the fonts are self-hosted, the icons are inlined, and there is no analytics before consent.
Instead there was a link to challenges.cloudflare.com on the homepage, which has no form on it.
It comes from the Turnstile module, which attaches a rel="preconnect" in hook_page_attachments() with no condition on whether the page actually contains a CAPTCHA. The intent is reasonable: warm the connection so the widget loads faster when it does appear.
Why it matters more than it looks
A preconnect is not a passive suggestion. The browser performs a DNS lookup, opens a TCP connection, and completes a TLS handshake. That is a real network round trip to a third party, and it discloses the visitor's IP address and the fact that they are on your site.
On a page with a form protected by Turnstile, that trade is fine, and the visitor is about to talk to Cloudflare anyway. On every other page it is a third-party contact the visitor did not ask for and has not consented to, which rather undermines having a cookie banner at all.
The fix
Strip it in the theme's hook_page_attachments_alter() everywhere except the one route that renders the widget. The detail worth knowing is that the module adds it to html_head, not html_head_link, keyed turnstile_preconnect_cloudflare. Matching on that key rather than on the URL means an upstream change to the endpoint cannot silently reintroduce it.
The wider point is that "nothing off-origin on first paint" only stays true if something checks. It is now an assertion in this site's test suite, because a contrib module can add a third-party request on any update and nothing will tell you.