this has happened becuase machine found a risk and it repaired risk and set this home page.
This setting is confogured under the AV/AS policy under Miscellaneous section.
Specifies a URL to use as the home page when a security risk hijacks a client computer's home page
The client uses this URL when it repairs the risk.
You can click the lock icon to prevent users from changing the home page to be used when repairing side effects after a browser hijacking.