I wasn't able to reproduce, but workers fall under "worker-src" directive. It has a fallback to "script-src", but I think it only controls hosts and schemes. Can't find a definitive answer in the specification. To block, set "worker-src 'none'".