Is Google Analytics tracking actually safe to use on pages with sensitive information?

Every third-party script has the ability to load every page on the same domain so the risk exists.

If you really need to track analytics on sensitive pages, consider doing it server side, and be sure to check that an analytics snippet loaded on another page couldn't load the sensitive page and read its contents (via AJAX, for example).