In case anyone is using protonmail and is curious about this: by default only DNS prefetch with the server's IP is leaked. Opting to load remote content leaks the reader's IP when grabbing CSS.