What causes the pop-up "To view this web content, you need to install the Java Runtime Environment"
For my sister this was caused by Facebook videochat. We debugged quite randomly, and could not find a way to tell what triggered this dialog; like indeed ps did not show what started it. But the following Apple Support Communities post explained how to find it by trial and error:


  Here are the steps I used to correct, as even after removal from Launch control it kept returning on reboot:
  
  
  Open a Terminal Prompt
  Show non Apple startup Agents. At $ execute

launchctl list | grep -v apple

  
  This will look something like the following.

PID Status Label
-   0      org.openbsd.ssh-agent
282 0      com.symantec.symsecondarylaunch.application
274 0      com.symantec.quickmenu.application
-   0      com.google.keystone.system.agent
-   0      com.valvesoftware.steamclean
-   0      com.oracle.java.Java-Updater
276 0      com.Logitech.Control Center.Daemon
302 0      com.google.Chrome.62228
-   1      com.facebook.videochat.USERNAME.updater
295 0      com.symantec.scannotification.application
-   0      net.tunnelblick.tunnelblick.LaunchAtLogin
275 0      com.symantec.savdiskmountnotify.application
317 0      net.tunnelblick.tunnelblick.119880

  
  One of the returned items is likely your issue, mine was also com.facebook.videochat.USERNAME.updater
  Change to the Agents directory, cd ~/Library/LaunchAgents/
  I also had to remove the actual agent files, as it kept re-appearing on reboot. You can view those on your system and remove. List out the items in directory: ls

SharedServices.Agent.plist
com.facebook.videochat.USERNAME.plist
com.valvesoftware.steamclean.plist
net.tunnelblick.tunnelblick.LaunchAtLogin.plist
org.virtualbox.vboxwebsrv.plist

  From ~/Library/LaunchAgents/ execute

rm com.facebook.videochat.USERNAME.plist

  Also remove from Launch control with

launchctl remove com.facebook.videochat.USERNAME.updater

  Exit and reboot
  


If I recall correctly then this videochat thing might also have been a plugin in her browser, which we then already removed earlier.