Given the incognito difference, I'd say an extension injecting content into the page. Extensions don't run in incognito mode by default. Try disabling them all and enabling one by one to determine the culprit.