What's the "Other Info" associated with the alert?
Are you sure you aren't encountering the CSP issue where you've failed to define a directive that doesn't fallback to Default Source?
Ex: https://github.com/zaproxy/zaproxy/issues/8700