Might be as simple as https://hola.org/ & https://luminati.io/ - "unblock a website, download our VPN client", meaning you "unblock" by using somebody else's line. And the also sell access at luminati. Most users aren't aware of the implications.
a) The type of "services" luckylion mentions where people have opted in to a shady gray market thing reselling proxies through their connection.
b) compromised home routers/gateway devices/internet of shit devices
c) compromised home PCs (mostly windows 7/10 trojans/botnets)