Google Ads suspended for Cloaking after “Compromised Site” warning — could a hacked website cause this?

Hi everyone,
My Google Ads account was suspended for “Circumventing systems: Cloaking.” Around the same time, Google also flagged the advertising destination as a “Compromised site.”
We have never intentionally used cloaking, so I’m trying to understand whether these two issues could be connected.
Could a compromised website, injected JavaScript, unauthorized redirect, geo/device-based redirect, tracking script, CDN/WAF configuration, or CMS/plugin vulnerability cause Google to interpret the website as cloaking?
Before submitting an appeal, I want to make sure the actual technical issue has been identified and completely resolved.
For anyone who has experienced this:
What exactly did you check or change to determine why Google detected cloaking, and what did you do before your successful appeal?
Also, is there a reliable way to compare what Google Ads/Googlebot sees against what a normal visitor sees?
Screenshots attached. Any technical advice or personal experience would be greatly appreciated.