Ads showing to Trust Levels that should not see them?

Does your install have Let’s Encrypt enabled, or are you only doing HTTPS encapsulation between CF and the server?