Hi Jamie,
Who is hosting your websites? I have had the same issue and mine are hosted with TSO Host on their cloud hosting. I have come across this page which suggests that it might be more to do with the hosting than the actual website https://guides.magefix.com/2019/10/repeated-sql-injection-malicious-javascript/
I hope this helps,
Tim
