All it takes is someone who has 5 minutes to lose to writes a shitty bash script that will curl your ads in an infinite loop. That may be the 'illegal activity' reported. As for the bans occuring a few day before payout, I'd be prone to think that the automated checks for such activity are not run in real time, but at a scheduled time close to a payout. That would explain why so much bans happens before payout (well, excluding malice from google)