SECURITY ISSUE: Spam email adding events to calendar

Follow the steps here by accessing your Google Calendar on their website. I only mentioned the Microsoft accounts because recently their servers have been under the same malicious spam invitations. By syncing those account to your Calendar app, you will see the same spam invites that appear on those mail servers show up in your Calendar. You can test that by stop syncing the Calendar with that account and if they immediately go away, you have found where they are coming from.

1. Go to Google Calendar on your computer.
2. Click the gear icon in the top-right corner and select Settings.
3. In the left-hand menu, click on Event settings.
4. Find the "Automatically add invitations" dropdown menu and change the setting to No, only show invitations to which I have responded.

• • This prevents events from appearing on your calendar unless you explicitly respond to the email invitation.
  • You can also choose "Only if the sender is known" to add events only from people in your contacts. 

I would recommend to only sync iCloud with your Calendar, but I do understand that some users have an interest in using a third party source for Calendar events, but that does come at the expense of also seeing those spam invites in your Calendar app. They are simply synced from that server and the spam would need to be blocked from appearing on the server to prevent it from syncing to your Calendar app.

See Delete calendars and events on iPhone - Apple Support

Are you using an Outlook, Hotmail, or Microsoft Exchange account and have it synced to your Calendar app?