WordPress theme without external resources/CDN, for privacy?

I just created a WordPress site and for now I chose the Penscratch theme. I’d like the lightest weight possible theme in terms of (tracking) websites contacted, to improve the privacy of my users.

I went to wp-admin/options-general.php?page=sharing and disabled Facebook, Google, Twitter sharing buttons. I still have some requests to Google made by the theme, like https://fonts.googleapis.com/css?family=Roboto+Slab and https://fonts.gstatic.com/s/robotoslab/. Is there a theme which doesn’t load any webfont, or any other external resource not loaded from the hosting server itself?

Alternatively, what’s the lightest-weight option to configure/customise an existing theme to remove any such external resources, from the admin panel and without requiring hacks to the theme’s files themselves? I want to avoid upgrade nightmares for the theme.