I have added a canonical tag, nevertheless Google index those URLs.
rel="canonical" tag doesn't necessarily prevent the non-canonical URL from being indexed. If the pages content are deemed the same/similar then the canonical tag should mean that the canonical URL is returned instead, in Google's "normal" search results. Note that the canonical tag is only advisory. If the pages are not similar (ie. not canonical) then it is likely to be ignored.
determining by using
Note, however, that a
site: search is not a "normal" Google search. It has been shown to return non-canonical URLs in the search results. URLs that don't ordinarily get returned in "normal" search. That is maybe what you are seeing here.
Instead, if you just search for a unique phrase on the page, is your non-canonical URL still returned in the SERPs?
I'm not concerned about these pages being indexed, ... inflict a penalty for thin content on my site?
If being indexed is not a concern anyway, then I don't see what "penalty" can be applied here? By the sounds of it, you are already implementing the cross-domain canonical so that should be OK.
However, as Closetnoc suggests in comments, if you have no other content on your site, apart from this "borrowed" content from other sites then you probably won't rank anyway. (?)