On the instances where you were starting to get 'bushed before you went to the party, did you bag Saadia for the Alik'r?
IIRC I've also been left scratching my head over Thalmor attacks that occurred before I got to Diplomatic Immunity or had any contact with them at all. I know for a fact that one happened before the MQ got that far *and* before I'd ever encountered and killed any of their patrols. And I've always turned Saadia over to the Alik'r, usually early in the game because my first 3 characters I went to Whiterun straight away and ended up doing a bunch of local quests just for the XP and the money so I could buy the house. So you may be on to something.
On this playthrough I went straight to Windhelm from Riverwood and joined the Stormcloaks, and never hit Whiterun 'til I was sent there as part of the CW quests. I didn't do Diplomatic Immunity until just before the battle of Solitude; I worked that and Missing In Action into the Liberation of Haafingar, because it just seemed to make sense to RP that infiltrating the Thalmor Embassy and wiping out the ones at Northwatch might be considered a vital part of the war effort. And I'm almost positive that I was never ambushed by any Thalmor all during that time. I have killed assassins that were carrying the note signed "E." but I'm pretty sure that's only happened since I finished Diplomatic Immunity.
I only just recently finished the Saadia quest this time around, when I finally returned to Whiterun and joined the Companions and bought Breezehome and decided to let Vignar make me Thane again. I'll be curious to see if that triggers any ambush attacks by the Thalmor themselves. In a way it will make me feel better if the Thalmor ambushes
are triggered by turning Saadia in to her pursuers, since that would seem to indicate that she did indeed betray her people to them and may still be working for them in some capacity.