phoney notifications

They pop-up then go away and I cannot seem to see where they originate from.

Evidently you granted permission for one or more websites to harass you with Notifications. Unless you have a valid reason for agreeing to that annoyance, your automatic and reflexive response ought to be "just say no."

Refer to this excerpt from Effective defenses against malware and other threats - Apple Community — specifically, the last bullet point below:

Beware spontaneously appearing, unsolicited popups demanding immediate action. Think before you click.

• ...
• If you encounter a website, popup, text message, email, or phone call alleging your Mac is infested with some ick or that you need to take immediate action lest dire circumstances ensue, it is 100% fraudulent. Ignore it. Read Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams.
• The same goes for website Notifications — attention-getting banners that appear at the top right corner of your screen. Safari gives you a great degree of control over them: Customize website notifications in Safari on Mac. Most of those Notifications are simply annoying, but some are intended to frighten and deceive you into installing something nefarious.

Review Customize website notifications in Safari on Mac - Apple Support, and remove the websites for which you granted that permission.

<< I am fairly certain the only ap running was probably email. >>

it is not as common, but some of the same stuff can be done to you by emails, especially if you leave

[√] load remote content in messages

This 'rats you out' to corporate message senders when you open such an email, and can send them your private information such as IP address, email address, and can also post banner alerts.

It is very difficult to casually infect a Mac without your active participation in providing your Admin password. Most of these bogus messages are generated by javascript in sleazy Ads from sleazy Ad services that pay web sites to carry the Ad service.

Some web site operators have no idea how bad they are, but if you notified them of your displeasure, some web site operators might take notice.

standard procedure is to, in this order (until you obtain relief):

close web page.

close browser.

Force-quit browser.

restart computer.

if you hold shift at startup, you will enter safe mode in may cases. No add-ons can load, but it may not be as productive as regular mode.

if you hold shift immediately after you login, no previously-running apps will open automatically.

if you hold shift as you open your browser, no previously-loaded web pages will load automatically.