Obviously, the Google Playstore is the problem.
The Playstore auto update Google Play Services, and don't car about your own settings with no-auto-update.
The Only way i've found it's to install Google app (wich should be present in settings [Google Quick Search Box APK]) uninstall Playstore, Google Service Framework, and Google Play Service. It's should keep your account google connected.
Then, turn on airplane mode, reboot the phone, then reinstall Playstore APK, Google Play Service APK (21.24.57)., and Google Service Framework (10).

Go to Playstore, Quickly disable airplane mode and refresh the app. Immediatly after homepage of playstore was loaded and be sure to be login, enable airplane again, then go quickly disable all data access for him in this system app settings (data). You have to be fast, and don't give too many time to the playstore wich gonna update Play Service.

Now, disable airplane mode, then try any apps wich depend of google services and framework, it should works, temporary.
Before any other alert of play protect certification (or even after), uninstall Google Service Framework (10) and install the modded Service Framework (attached files) and don't allow him to read your contacts when he gonna try first connexion to google.

Now you should'nt have any certified error, and no auto-update of the oogle Play Service (21.24.57)

If You want access to the playstore, never give network access to the playstore app, you have to replace the playstore google app by Aurora store, wich is an open source client of the playstore, getting apk directly on the google playstore servers with fake id or your own account: https://f-droid.org/fr/packages/com.aurora.store/