The need for it to run on system boot is strange, but unless Ren'Py (or VsCode) themselves are purposely sneaking in malware I highly doubt it's anything to worry about.
In terms of adding porn pop-ups/adverts, I've downloaded the project from here countless times for testing and haven't had any problems with that. Anecdotal as that evidence may be.
That being said, I respect not wanting to put your PC at risk.
If I come across any way to prevent Ren'Py from adding such files, without breaking the project, I'll be sure to do so.
The project currently uses v8.3.4, maybe try finding some other projects that use the same version to see if the same ping is given?