Welcome to the Q&A Forum

It is worth mentioning that whoever owns these websites does mass linking on purpose. They have introduced a charge for a 'Delete Link' service that costs $36. This is a textbook example of a soft form of "digital extortion".

Unfortunately WordPress is always vulnerable if the installation isn't properly managed. I would suggest you to check if there are any links to your websites for spammy domains, phishing domain links farms or any other domains and website of poor quality.  If there are any, go to Google and use "disavow backlinks" option.

Any news releases related to the websites would also help. It is not a bad idea to create a publication in your Blog (if any) that explains how a compromised WordPress installations resulted in a drop in SERP.

Consider using this WordPress plugin - https://wordpress.org/plugins/meta-tag-manager/

A professional review of the WordPress installations by any 3rd party would also help, as you might be missing something. Finally, consider using a Managed Website (Managed Wordpress) service.

I would suggest to create a Blog to publish articles that explain anything related to your business. If you can tell stories about the process of creating your product, what have inspired the creating of certain product, this would be a very good content, which adds up.

As the question is interesting, I went to search and I did not find anything that explains hoot legitimately modify the GA tracking script. May I ask you why do you want the script to not cookie non-US visitors to your website?

I don't think that you should be looking at those from a SEO perspective. Why? If some people landed there through the search engines, this means that they have found the result in the SERP useful. This is much more important that the SEO. There are many who work for SEO, but do not manage to attract interest from those who search Google or other SE. So, keep and develop you internal search pages.