Well, one of the options is that the servers you visit are “infected” - does it happen when visiting certain websites?
That can hardly be blocked - these are web ads hidden “inside” normal advertising networks.
For more information you can read this (slightly older) article: https://www.androidauthority.com/mobile-scareware-ads-338182/
I have given your e-mail address to a colleague of mine, who can try to help you (as soon as he is back from holiday).
Good luck!