In order to implement CSP on my website, I disallowed 'unsafe-eval' in script-src directive. But I cannot track visitors with Piwik, because piwik.js tracking code contains call to eval function twice.

Can you consider rewriting the code so it does not use eval? (Which is a bad idea nevertheless.)