We had this problem on clojars.org until a few months ago when someone contacted us about it. While we weren’t explicitly sourcing 3rd party JS, some of our sponsor links were to their CDN’s.