Where they come from
Anyone can send tokens to any address. Scammers airdrop worthless tokens with a claim link baked into the name or a linked site.
The risk
The tokens themselves are harmless to hold, but interacting with their claim site or contract can trigger a drainer signature.
What to do
Leave them alone. Do not click links in token names, do not approve or swap them, and hide them in your wallet if the option exists.