Commented the X-UA-Device, as we found out, that Google could interpret this wrong. Google marked our site as "hacked" without any real hack going on. We removed only that X-UA header, getting marked as clean again. It seems that Google is interpreting this as crafted content only for SEs (X-UA-Device:bot) as used by Viagra, Cialis SE hacks on servers (showing nothing to the browser, but spamming SE index with spam for bots)