"Why would I report someone that might be selling CSAM?" There's a lot of things I can and will overlook. CSAM isn't one.
Well, here there's two offenders - Meta and the ad seller. Honestly, I suppose the best bet here would be reporting the ad to the FBI. Assuming I'm a snitch, that is...
I know HR is not my friend. HR looks out for the company. If you and the company's interests are aligned, lucky you. If not, not so much.