Final report... false alarm.
NORD VPN's 'threat protection' is beta... and still causing CIS to throw this error. According to it, it's 'blocked 14 attempts' from CIS; no breakout of what it blocked though (ads, trackers, malicious websites and files).