From my experience looking at sites for improvement opportunities, if the site is ad-monetized, it's the ads, otherwise the frameworks are multiple times the tracking stuff (analytics etc). Oh, and of course google tag manager is used to load analytics and nothing else, because you need those extra 240kb of JS to feel complete :(
In my experience? For SPAs, it's mostly 1) bad use of the framework, causing way too many pointless DOM updates, and 2) doing lots and lots of network requests, and particularly blocking requests.
2) is a bit due to tracking, but usually mostly a consequence of the API-first design. Despite using a large and powerful framework, the app itself does very little locally, as anything non-trivial ends up being a blocking network request, or a burst of several such requests (usually not blocking the app itself, but almost always blocking the user from continuing until the requests are done).
We could start by stopping using these stupid pointless frameworks that provide little functionality but reams of overhead.