I’m not a lawyer, but according to my information, the GDPR prohibits the disclosure of personal data to third parties (anyone) without explicit consent. The IP address of the website visitor is already considered personal data and it makes no difference if fonts are loaded from Google, Bunny Fonts or any other external server. The use of Akismet and Jetpack also does not comply with data protection requirements.