Repeated CVE-2015-7547 warnings from one machine

Wifey's Win 10 Pro box is causing these warnings. Not constant, but once or twice a day. First started a day or two ago. I'm running DoH with Cloudflare and Google. And these are getting blocked, so maybe not a big deal. But I'm wondering how this is happening with secure DNS. I'm no DNS expert, so I'm hoping someone can enlighten me about what this is exactly. I've read the CVE, but I still don't understand how or why it's happening. I have a full Unifi system running through a UCG Ultra. These warnings are coming from both 1.1.1.1 and 8.8.8.8.