I would definitely rule out that external JS! I haven’t heard of this behaviour before, and something about it pointing to a free trial and a VPN just smells (I know, not very technical, BUT) like a hijack or virus to me.
If you can find a way to reproduce this or similar, or you can rule out anything external, we will absolutely try and find out what is going on, but otherwise, we can’t do much at this time, i’m afraid.