Hijack.Tray?

Yesterday afternoon 6 of our company computers lost connection to the domain. They could not ping any of our ip address nor get on the internet without it showing "Page cannot be displayed". This was an intermittent problem. Sometimes they could work just fine. That lasted about 5-10 minutes then they would go down again.

We did a Malwarebytes scan and it revealed about 10 low level hijacks. Including:
PUM.Hijack.DisplayProperties
PUM.Hijack.StartMenu
PUM.Hijack.Explorer
PUM.Hijack.Run
PUM.Hijack.Help
Hijack.Tray

The Hijack.Tray was the only one that was RED.

All of these "infections" were in the registry. We use roaming profiles and we serve all of our users desktop backgrounds, icons, etc. from the server.

We have GPO settings that restrict the tray and taskbar settings so that every computer is exactly the same.

After clicking "Quarantine All" on Malwarebytes and rebooting the machines, they were able to get back on the network. Until this morning. 3 of the 6 machines are down again and the problem has now migrated to another set of computers.

Has anyone seen this before? Is it being served from our Domain Controllers to the local machines?

Thanks.