I appreciate the suggestions. I still have not located the source of this problem, but did manage to identify and fix a few more security vulnerabilities.
All the scans keep coming back clean with the exception of the above-referenced html files, which I delete.
It’s essentially just a form of spam and not a major problem, but it is a nuisance.
Thanks!