How can you cross-correlate them? Most people are viewing the internet from behind a NAT, so there isn't a one-to-one mapping between IP address and person.

Plenty of ways, for example: https://panopticlick.eff.org/

and from there:

https://panopticlick.eff.org/results?#fingerprintTable

Pretty much all of those fingerprints require the ability to run javascript on the client side. Getting static content from Google doesn't allow them to do any real fingerprinting. Obviously, if you're executing arbitrary code provided by Google, they will be able to track you pretty much always.

You cross correlate IP address and request header parameters (such as user agent, language etc) with previous requests (or future requests) with the same configuration but with known identity.

It does not give you perfect match but is much more precise than just the IP address and with limited number of users would be probably sufficient to distinguish different users behind single IP address.

I think you're overestimating the entropy of the request header parameters (assuming no cookies). How are they going to distinguish me from all the other English-speaking Windows users using Chrome? True, it is better than nothing, but I'm not sure what you could do with such low quality tracking data. You might be able to do something with that, but I can't think of any possible way to use that to violate my privacy.

To clarify it further, for the case I described, I did not assume a user that actively tries to suppress the signal to Google, but assumed a user that only does not visit Google search (or any other its services).

I then assumed that at certain moment this user can be uniquely identified (by AdSense, Analytics etc).

Then accesses to pages without active tracking but with links to Google fonts or other passive API can be still identified with high confidence given the access happens from the same network.

I do not know if such extra signal is interesting for Google, but it can be acquired. Also mind you that using an ad blocker is also a signal and can be assumed from the access pattern.

The same logic applies also to an user who uses ad blocking but still uses limited Google services.

Again I do not know how much Google finds this kind of signal interesting but it is possible to collect it.