How can I find out if my phones credentials have been compromised

[AC Question]

I have a Cubot P9 and it has work really well until I visited South East Asia recently.
Before I return and now I keep getting un-asked for downloads and installations including nibblers, snowfox, and wowcher, Just Eat and Daily Yoga to name but a few.
These come when I try to download from the Google Play Store or leave the phone with the wifi on overnight. Data roaming is disabled on the sim card.
I have replaced the sd card with a new one after resetting the phone via power\Volume and and doing a factory reset in settings.
I have used avast, stubborn trojan remover and kaspersky to check for malware and viruses. All report the phone as clean. But still the crap comes back.
If an unsecure credential was added to the phone credential list when I was away, would this cause the problem, and how does the credential survive to recovery>
How do I stop this problem and if it is a credential, which from the long list can I safely disable?

 

[Rukbat]

That's not "credentials", that's ads. Use an ad-blocker, an antivirus app and Malwarebytes Anti-Malware to get rid of that junk.