After a full day of troubleshooting the virus warnings our users were getting we identified the culprit... SweetCaptcha is purposely injecting pop-up ads into the footer of every page. On first user click the pop-up is engaged. Uninstall and reprot.
https://wordpress.org/plugins/sweetcaptcha-revolutionary-free-captcha-service/