I would first remove any plugins that are not needed, or any that haven’t been updated for a while. Then I would install all updates (themes and plugins) and reinstall WP (all from the Admin, Update screen). That will get you a fresh install of WP and plugins/themes.
Then I would manually look at all site folders for files that are not the current date (all ‘good’ files would have today’s date, because you updated everything). (I might even go so far as to reinstall plugins/themes from the WP repository, if there were no updates. That gets you current on everything.) Any file with a date outside of today would be looked at for nefarious code.
Then I would change all user credentials (WP admins at the very least), plus hosting account and FTP users, using strong (and new and different for each account) passwords.
That should clear up any possible bad code. Then I’d look at the page source of a few pages and see if there is any possible code that is not supposed to be there.
The result should be a ‘clean’ site. Then monitor the site to ensure ‘cleanliness’.