I have advanced blocking in uBlock Origin and all 3rd party scripts are blocked by default. Not sure how DDG came there (maybe because I came to Kagi through it?), but I have checked agsin and for CF it says:
d33q65j1hc8iiu.cloudfront.net
assets.kagi.com
I assume you are using CloudFlare as CDN for your assets (can't check right now)? If so, it is a weird decision for a privacy focused search engine. Of course there are degrees to privacy, but CF is too big to be trusted imho.
EDIT: no, no extensions apart from UBO. :)
Would be nice if you double-chcecked both claims before making allegations publicly (or at least contacted us for clarification) as we do not have the resources of a big company to right all the wrongs said about us.
Everything about Kagi and privacy is available at kagi.com/privacy
If it matters, you sure made the mark for me, and I will definitely check out the engine further.
Care to explain what exactly you saw as I am curious (Kagi dev here, and no, we don't make such requests - likely to be your browser extensions).