Hello,
I made an account here just so I could help you, and possibly others, seeing as no one responded to you.
I have only just solved this issue and in my case, the culprit app is SHADOW THEME APEX/NOVA/ADW/GO.
It could possibly be something else for you that was made from the same people. Either way, the method I will mention below could help you resolve the issue without wasting your time on with antivirus and malware finders.
I had the same experience as you mentioned above plus other various pop ups.
One pop version would provide you an opp out link and that link would take you to a webpage that instructs you to do some suspicious things.
I spent days trying to track down which app was doing this and ended up targeting and uninstalling innocent apps only to find that the problem continued.
No antivirus or malware app was able to help me get any closer to figuring this out. I was only able to find it thanks to a system processes app that allowed me to watch what was running on the phone in real time. What shadow theme does, is it turns itself on (probably to see if you are actively using the phone) it then connects to a location in Ashburn, Virginia, USA Lat 39.0437, Long: -77.4875. It then turns itself off 0.5 seconds before the ads pop up....EACH TIME!
The app that I used was OS Monitor by eolwral version 3.5.0.7. It allowed me, via the 'status', setting to see which app was running and which ones were asleep. And when the only 2 apps running are OS Monitor itself and the phones own system, anything else that pops up is going to be easily caught. And that is what happened.
Hopefully this knowledge will help you track down dodgy apps on your phone, but as I said, in my case it was SHADOW THEME APEX/NOVA/ADW/GO.
I have no connection with OS Monitor app or developers. I am just someone that went past his bed time to resolve an unnecessary issue that his phone had. However, I am very thankful for the app.
I will attempt to add some screenshots.