Circumventing systems, compromised site

I have been trying to get a campaign running for months, but I keep running into "Ads disapproved" because of "Circumventing systems" and "Compromised site". I have no idea why I keep getting these, they show me very little information or explanation. I read through the policies and still have no idea whats wrong. I am not trying to sell illegal services, Im not trying to abuse the ad network, Im not distributing malware. In fact, the site is just a few statically rendered pages. I keep appealing the disapprovals but it keeps happening.

The only thing I can think of is that I bought a nextjs template to use for the site. At first it had some other pages and metadata that I didn't think to remove. So maybe Google scraped some of that stuff and got confused? I have double-checked that I thoroughly removed all the extra template code but that didn't seem to help.

After a while I got desperate and even bought a completely new domain name, set up a new google account, and created a new campaign from scratch. The ads ran for about 12 hours and then got disapproved again.

Has anyone run into this? Any ideas on what I could be doing wrong? Im happy to share the site if it helps, but I don't want to get flagged for spam. I have a different campaign running for a different project, so I don't think its an account-level issue.