Privacy Badger blocks CDN, although no cookies etc

I'm developing an embedded commenting system, like Disqus but open source, no ads, no tracking. There's SaaS hosting and a CDN.

Privacy Badger blocks the CDN — not immediately, but later, after I've visited a few (three?) different blogs, with the comments embedded. The CDN sets no cookies. The scripts from the CDN, reads from, but haven't written to, localStorage (they could do, though). No canvas fingerprinting. Still the CDN gets blocked.

Does the CDN need to be added to the yellowlist? (i.e.: https://github.com/EFForg/privacybadger/blob/master/src/data/yellowlist.txt )
Some other similar software (Discourse) is on the yellowlist. (e.g. `cdn.discourse.org` and `disqus.com`)

(Here's one place where the embeded comments are being used, in case you'd like to understand better what it is: https://www.kajmagnus.blog/new-embedded-comments. Scroll down to see the embedded comments. (it uses a different older & deprecated CDN CNAME though so won't get blocked))

#### Tech details:

The blog post HTML page loads an iframe for comments, and another iframe with a text editor. Both iframes have origin `comments-for-(blog-addr).talkyard.net`. And these two iframes, load scripts from `cdn.talkyard.net`. Here's how it looks, for [this Jekyll demo blog post](https://jekyll-demo.talkyard.io/2018/01/09/installation-instructions.html):

```
// The blog post HTML page loads:
installation-instructions.html from jekyll-demo.talkyard.io (normally, .net not .io)

// It loads a tiny script that creates the iframes:
talkyard-comments.min.js from cdn.talkyard.net, initiator: installation-instructions.html

// The iframes load:
embedded-comments?discussionId=demo-and-inst-instr…yard.io/2018/01/09/installation-instructions.html from: comments-for-jekyll-comments-demo.talkyard.io, initiator: talkyard-comments.min.js
embedded-editor?discussionId=demo-and-inst-instrs&…yard.io/2018/01/09/installation-instructions.html
from: comments-for-jekyll-comments-demo.talkyard.io, initiator: talkyard-comments.min.js

// Inside the iframes, more scripts are loaded:
polyfill.min.js from: cdn.polyfill.io, initiator: embedded-editor?discussionId=demo-and-inst-instrs&embeddingUrl=https://jekyll-demo.talkyard.io/2018…
i18n.min.js cdn.talkyard.net initiator: embedded-editor?discussionId=demo-and-inst-instrs&embeddingUrl=https://jekyll-demo.talkyard.io/2018…
slim-bundle.min.js cdn.talkyard.net initiator: embedded-editor?discussionId=demo-and-inst-instrs&embeddingUrl=https://jekyll-demo.talkyard.io/2018…
polyfill.min.js cdn.polyfill.io initiator: embedded-comments?discussionId=demo-and-inst-instrs&embeddingUrl=https://jekyll-demo.talkyard.io/20…
i18n.min.js cdn.talkyard.net initiator: embedded-comments?discussionId=demo-and-inst-instrs&embeddingUrl=https://jekyll-demo.talkyard.io/20…
slim-bundle.min.js cdn.talkyard.net initiator: embedded-comments?discussionId=demo-and-inst-instrs&embeddingUrl=https://jekyll-demo.talkyard.io/20…

// (cdn.talkyard.net is a DNS CNAME for Keycdn's CDN, b.t.w.)
```

### Problem

So, PB thinks the CDN is a tracker, because 1) the CDN is present at many differen websites (blogs), plus 2) some other reason(s) that I don't understand? (or is 1) enough?).

The embedded HTML comments pages, on the `comments-for-(blog-addr).talkyard.net` domain, currently *do* set cookies, always: a XSRF security cookie, and a browser id cookie for assisting with rate limiting and blocking bad people, and a session cookie if one logs in. But this shouldn't matter? The embedded comments HTML pages (`comments-for...`) are reachable only via one website (i.e. the blog where the comments get embedded). So the [seen at 3 different places so it's a tracker] rule then cannot be broken? ...

... Nevertheless, the `comments-for...` requests *also* get blocked by Privacy Badger. So, it's both the CDN (although no script, no localStorage, no fingerprinting), and the embedded HTML pages (they do set cookies, but are only embedded at one singe blog, each.) — I'm surprised that any of them get blocked?

Going to `chrome://settings/siteData` in Chrome, there're lots of cookies when I search for `talkyard.net` — but they are all on subdomains like `comments-for-...talkard.net`. (And no cookies on `cdn.talkyard.net`.)

What do you think? What are the next steps to take, to fix this problem? or to continue trouobleshooting? I ran an "action map" script, see my comment below.

(Thanks for reading all this b.t.w. :- ))