My client is getting this CORS error in experience builder:
Access to fetch at 'https://maps.gov.bc.ca/arcserver/rest/services/mpcm/bcgwpub/MapServer/474?f=json' from origin 'https://experience.arcgis.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://governmentofbc.maps.arcgis.com' that is not equal to the supplied origin. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
He added this map service (https://maps.gov.bc.ca/arcserver/rest/services/mpcm/bcgwpub/MapServer/474) to a webmap in ArcGIS Online and save the map.
In experience builder, he is getting the CORS error when trying to select the web map and add data.
I couldn't reproduce the same CORS error the first time, but I could add it the 2nd time.
He couldn't reproduce the issue with sampleserver6 so I think it could be related to some CORS setting on the web server.