I took the first of these, and fetched the complete JSON body.
It contains a t.co link that points to a shortened URL. That URL expands to another URL, that contains the string “PPE”.
So, the search in this case is matching on the full target expanded URL. Your search is specifically requesting Tweets that contain links (filter:links). Unfortunately the API does not have a way to prevent that parameter in the target URL from being picked up. You’ll need to filter out the URLs in your query using the -term syntax. I’ve just run the same query using the target URL name in my negative query alongside the PPE as the main keyword, and it seems to come out cleaner.
