Check for links going to the staging site. I’ve seen the “malicious software or contaminating features” flag in accounts for that reason a number of times. Google ads also caches the page, so once you do find/fix what you’re looking for, it’s usually 3-5 days for the flag to be lifted.