Its looking like a form of infected ads ive seen before. they usually find a way into some ad provider. Ive had to track similar issues for a few sites before. It was always coming from an ad provider, usually through some javascript injection nonesense