As @Philipp has already stated, the most likely cause of the inserted advertising is coming from the end users machine IMHO. I would like to expand upon his point about proxy traffic.
The reality is that any hop in the network path is capable of altering the traffic/inserting code. There have been examples of this happening at a government level and also at an ISP level and you didn't mention if your app is served over a secure connection? (not that https is any guarantee these days).
Other examples of ISPs inserting advertising can be found at superuser.com (question 652995) "Why-does-my-browser-try-to-open-ads-from-fwdsnp.com" (sorry, rep limited for <2 links) and also a blog post by Eric Helgeson on his github.io titled "I fought my ISPs bad behavior and won"(google this).
Taking my tin foil hat off for a couple of moments... Other answers have touched on browser extensions, I recently had a client ask me to help clean his PC that was displaying similar symptoms to your end user. However, this adware(malware) was inserting itself onto only a specific set of websites. The client had first noticed the advertising on my country's equivalent to ebay - where the adware would insert an image into the last slot of the gallery slider of the item the user happened to be looking at. Clicking on the inserted image would whisk you off to a third party auction site, complete with affiliate links for good measure. When browsing amazon, ebay, [insert well known shopping/auction site here] the end result was the same.
Turns out the cause was a browser extension in chrome. I was able to narrow down the possibilities quickly by asking my client to check and see if the symptoms persisted in I.E or Firefox - answer came back 'no extra ads'. 'Could he please open a chrome incognito tab and re-test?' - nope, no inserted advertising there. 'Installed any browser extensions recently?', 'ah yes I have - funny you mention it, I found a great little extension that helps take screenshots...'
I understand that you are a asp.net developer and not a help desk, so trouble shooting your end users machine shouldn't be your concern. It may help them(and you) if you can lock onto where and when your app displays these ads. Do they have a secondary broswer they could test it on? Does it happen at home, or only at work etc. Depending on the nature of your app it's not beyond the realms of possibility that some malware writer loves you enough to write some code that focuses on your app. (puts tin foil hat back on...)