Only on the internet - correct?
Use Task Manager to observe what apps, processes, and services are running both online and offline.
Look for some difference and google accordingly.
Could be some keyboard customization (from game, add-in, or app) that managed to get installed.
Be patient and watch everything very carefully. Try to narrow down the sequence of events and any patterns to it all.