Font files are small and on the critical path. A third-party font host adds DNS, TLS and privacy surface. Self-host WOFF2 on Cloud CDN under your hostname.
WOFF2 is enough
Current browsers speak WOFF2. Skip extra legacy formats unless you still have a reason. Version the filename when the face changes and long-cache it.
CORS on the font hostname
If fonts are on a sibling host, set CORS so the site origin can use them. Many teams simply put fonts on the same distribution as the site.
Preload without over-preloading
Preload the one or two faces used in the first paint. Preloading every weight fights LCP.
Licensing still applies
Self-hosting does not change the foundry licence. It changes the delivery path.
