Could just be an expired cert.
I don’t believe so. Why would the Brown campaign use the correct http in some ads but the incorrect https in others? The “infected” ads are all hosted on Yahoo. The ones not hosted on Yahoo work properly. It smells to high heaven, IMHO.