PrimeFaces CSP does not work with Mojarra f:ajax, it works however with MyFaces f:ajax. See our documentation: https://primefaces.github.io/primefaces/15_0_0/#/core/contentsecuritypolicy?id=known-limitations