This is not some DNS spoof. The ISP is actively altering web requests and injecting their own adware. If you look carefully at your snippet, the variable which stores a GET request has as part of that request a command to pipe part of a google javascript file through it's own code.
A quick look on the web for similar complaints points to the ISP picking some random (the first listed? all?) script tag on the returned page, and rewriting it to point to their own adware script which then pipes the original script through their servers. If I had to guess, I would say they are also probably doing this for their own profit as well (google ad revenue etc, not just by feeding you ads, but possibly rewriting any google analytics calls from the originating script to make it look like their content etc etc).
You should drop them, this is shady and they lie about it. You might also want to drop a line to google. They may or may not be are messing with their analytics but what they are doing is against google policy for ad partners.
I would be curious to see what an https request looks like...