CSP 'self' is failing in various directives - content-security-policy

Question

I've recently added CSP to my website and started testing it (Report-Only): it looks OK except for some reports I cannot make sense of.
Specifically I am seeing violations for resources that should be allowed by a 'self' directive.
The server is running Express and CSP is served through helmet-csp. I've validated the CSP policy headers with multiple services (e.g. https://csp-evaluator.withgoogle.com/) and it comes out error-free.
I am using report-uri.com to collect and analyze CSP reports.
This is the helmet-csp setup:
app.use(csp({
directives: {
'default-src': ["'none'"],
'object-src': ["'none'"],
'script-src': ["'self'", (req, res) => `'nonce-${res.locals.nonce}'`],
'connect-src': ["'self'", (req, _res) => (req.protocol === 'http' ? 'ws://' : 'wss://') + req.get('host')],
'manifest-src': ["'self'"],
'worker-src': ["'self'"],
'style-src': ["'self'"],
'font-src': ["'self'"],
'img-src': ["'self'", 'data:'],
'base-uri': ["'self'"],
'form-action': ["'self'"],
'report-uri': '[REMOVED]'
},
reportOnly: true
}));
This is the resulting CSP header:
Content-Security-Policy-Report-Only: default-src 'none'; object-src 'none'; script-src 'self' 'nonce-[REMOVED]'; connect-src 'self' wss://MYSUBDOMAIN.MYDOMAIN.it; manifest-src 'self'; worker-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; report-uri [REMOVED]
These are some example of the reports:
{
"csp-report": {
"document-uri": "https://MYSUBDOMAIN.MYDOMAIN.it/",
"effective-directive": "worker-src",
"original-policy": "default-src 'none'; object-src 'none'; script-src 'self' 'nonce-[removed]'; connect-src 'self' wss://MYSUBDOMAIN.MYDOMAIN.it; manifest-src 'self'; worker-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; report-uri [REMOVED]",
"blocked-uri": "https://MYSUBDOMAIN.MYDOMAIN.it/notification-worker.js",
"line-number": 1,
"column-number": 1966,
"source-file": "https://MYSUBDOMAIN.MYDOMAIN.it/js/index.min.js"
}
}
{
"csp-report": {
"document-uri": "https://MYSUBDOMAIN.MYDOMAIN.it/results",
"effective-directive": "img-src",
"original-policy": "default-src 'none'; object-src 'none'; script-src 'self' 'nonce-[removed]'; connect-src 'self' wss://MYSUBDOMAIN.MYDOMAIN.it; manifest-src 'self'; worker-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; report-uri [REMOVED]",
"blocked-uri": "https://MYSUBDOMAIN.MYDOMAIN.it/img/icon_twitter_black.png",
"line-number": 82
}
}
{
"csp-report": {
"document-uri": "https://MYSUBDOMAIN.MYDOMAIN.it/results",
"effective-directive": "style-src-elem",
"original-policy": "default-src 'none'; object-src 'none'; script-src 'self' 'nonce-[removed]'; connect-src 'self' wss://MYSUBDOMAIN.MYDOMAIN.it; manifest-src 'self'; worker-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; report-uri [REMOVED]",
"blocked-uri": "https://MYSUBDOMAIN.MYDOMAIN.it/css/results.min.css",
"line-number": 8
}
}
There are ten or so similar reports (different images and css files, but identical report structure) and they all came from Chrome on Android.
I don't understand why all these reports were sent: in every case the relevant policy included the 'self' keyword.
Am I missing something obvious?