I wouldn't expect roos to be part of Canvas. From the pages, it would have had to been a page called roos, not a file.

The speedtest.net extension isn't part of Proctorio, it's something installed in the browser and available from the toolbar. It's possible that it has a relative link that gets added to the end of whatever site you're on. The link you provided would have shown up if the student was on the Pages list and a relative URL was added to the end. It seems strange that the student would have done that many requests from the list of Pages -- even if the list of pages is available in your course (I have it disabled in all of mine).

The thing with extensions is that you can grant them permissions that are pretty invasive and can cause a slow-down themselves. For example, there are shopping extensions that take look at every page trying to find better prices for you. Extensions like those, ghostery, adblock, and others have been known to cause issues. Proctorio is another extension designed to keep make the browser secure by taking over control.

It is possible for a website to detect which extensions you have loaded, but . I've seen websites that tell me I have an adblocker loaded and to disable it if I want to continue using their site. I found a 2017 article on how sites can identify you by which extensions you have loaded that says one way they can try to detect ghostery or adblock is to attempt load their images. So, if roos/* is a path to an image from an extension -- and it appears that it is a path to an image -- then it might be some webpage trying to detect its presence. Another way is by trying to looking for modifications the extension makes to the DOM. For instance, if I try to load an image and it doesn't get loaded, there might be something blocking it.

Since Proctorio is designed to prevent access to other sites, it would be a prime candidate for trying to detect bad extensions, but I have no evidence that this is what's happening.

Still, an extension could modify the URL and if they didn't do it correctly, it could show up like what you're seeing.

As for detecting browser extensions, I found an article from 2019 that explains how to detect browser extensions. I didn't come across any recent data, so Chrome may have fixed the issue or I might not have been searching for the right thing.

In general, if a student is having any kind of problems, they should probably cut back on their extensions -- or remove any McAfee or Norton installations. When people are experiencing weird things on their computers, one of the first things we have them try is incognito mode (many extensions are not loaded in incognito mode) or a different browser.