In general, under the GDPR it doesn't matter much whether you process data yourself on your own server or contract that same task out to a third-party. Either that processing is legal or it isn't - ownership of the server doesn't play a role.

The problem with Google Analytics here is not that it's a third-party but that it's under US control.