It did not recur during clean boot (but it wasn't happening just prior to the clean boot either) - just to note, the MalwareBytes service could not be disabled (it immediately re-enables itself, probably as some kind of self-protection).
If you can be confident it never occurs after a clean boot, that makes it simple- a process of elimination based on your startups.
I've tried re-enabling the services and startup applications a few at a time, but no combination caused the message to be shown (although I wasn't seeing it before the clean boot either - it was just a few times several days ago and then not since).
If it's infrequent, you may need to try leaving it overnight.
You could try disabling all security software - then if the home page is changed, you can see what it's changed to.
However in this:
https://www.malwarebytes.com/pdf/gui...14-33-44--0700
I see nothing about home page protection....
Example of home page being hijacked: note in this case it's not reset.
IE 11 has been hijacked
You might try posting a list of all running processes. Might show something..
Save a List of Running Processes to a Text File in Windows
Quote