It was antivirus in my case. It has web scan feature that MITMs https sites locally. Disabling the feature made it "MITM unlikely".