OK good!
We turned on an old ad network today and it looks like that has told us what we need to know. That's where the bad redirect is coming from.
Sorry again for the inconvenience. But at least we feel we can block it securely from happening, at least from that network.
If this pups up again in the future, please let me know.
Paul