So, if there are no tags and no embedded pictures in the file - where do you see MP3tag's part in the investigation of this phenomenon?
If it is the player that shows strange functions, I would ask the player's support.
And as this is a local problem, you have to be as investigative as possible and as supportive as possible as no one can look over your shoulder from the distance.
So please have a look at this thread:
esp. the part about checking the files for integrity.
And then check the file system for left-over picture files
and then the player for unwanted internet access.