Hi @gijo
Yes, the inline JS is enqueued. Here’s a paste of the relevant html source code when logged in, which includes one of the tags that’s not being rewritten.
It looks like the data-src attribute is not being correctly populated. When logged in it has “data:text/javascript;base64” as the value, when logged out, that points to the script location.
<script async="async" type='text/javascript' id='akismet-form-js' data-type="lazy" data-src="data:text/javascript;base64,"></script><script type="text/javascript" id="flying-scripts">const loadScriptsTimer=setTimeout(loadScripts,3*1000);const userInteractionEvents=["mouseover","keydown","touchmove","touchstart"];userInteractionEvents.forEach(function(event){window.addEventListener(event,triggerScriptLoader,{passive:!0})});function triggerScriptLoader(){loadScripts();clearTimeout(loadScriptsTimer);userInteractionEvents.forEach(function(event){window.removeEventListener(event,triggerScriptLoader,{passive:!0})})}
function loadScripts(){document.querySelectorAll("script[data-type='lazy']").forEach(function(elem){elem.setAttribute("src",elem.getAttribute("data-src"))})}</script>
<script type="text/javascript">
(function() {
var request, b = document.body, c = 'className', cs = 'customize-support', rcs = new RegExp('(^|\\s+)(no-)?'+cs+'(\\s+|$)');
request = true;
b[c] = b[c].replace( rcs, ' ' );
// The customizer requires postMessage and CORS (if the site is cross domain).
b[c] += ( window.postMessage && request ? ' ' : ' no-' ) + cs;
}());
</script>