No, everything is local. This issue is much more complicated I’m afraid. I don’t think the security header conflicts with this.
The plugin gathers the used resources, generates the required javascript file and enqueues it. The generated file contents are correct on the dev site, but somehow incorrect on the live.
Somehow in the “generator” the analytics module is not included – and I don’t see why that happens. After cheking the source code it could only happen if the analytics is disabled, but interestingly the server reports that it is actually enabled.
So it’s basically enabled at one point, disabled at another – which hardly makes any sense, unless there is an issue somewhere, possibly a conflict or something with the data.