Every script loaded from another domain can read cookies, see the URL, and exfiltrate data from your page. Audit them, justify them, and lock them down.
EDPB Guidelines 2/2023 on Technical Scope of Art. 5(3) ePrivacy Directive