Maybe ads are leaking through the IPv6 DNS server(s) configured on the Win client:
netsh interface ipv4 show dnsservers
netsh interface ipv6 show dnsservers
Or the DNS answers coming from the DNS server(s) might be malformed/protected by some AV software: