We are having ads pop up on our webpage, at random times… from links that didn’t exist before, i.e. some random text on the page(which wasn’t a hyperlink) becomes a Javascript-y link-ad.

It’s the ultimate UI-fail… I find this fascinating – and want to know how this happens.
A friend just told me it’s ” spyware on your machine. Try cleaning up all cookies. “
Is that so? Like always?
I would guess they are injecting javascript into a form somewhere on your website. When the user views a page where the entered data is displayed, the javascript runs, showing the adds.
View the source of the page; do you see a script tag that points to a domain that is not yours?
If it turns out to be a XSS, you need to sanitize the data before it gets presented to the user (among other things). Here is a good starting place.