From what security software is doing this?

From none, on this machine is only the windows defender installed on some messages its pretend to be avira, messages like avaria found 5 critical viruses, but you can see that the notification origins from firefox

I think it is take messages from brnok.axegrinder.top website, but we dont open that or other suspicious sites.

Looks like fake messages pretending to be from the Firefox web browser which does not have any antivirus type of scanner feature built in Firefox on Windows, macOS, or Linux. Could be some form of malvertising as this was a culprit when there was fake Firefox updates going on (Chrome/Chromium users got the same sort of fake updates then also)

The brnok.axegrinder.top site you mentioned was suspended.

https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work

How can I determine the source ?

You should look online for how to find what is the infection from the message your getting and if your unable to determine what is going on a computer shop is the one you need to take this to determine what is happening. Firefox forum isn't here to help diagnosis computer infections or malware that is for a computer shop to identify this problem.

It is difficult to trace back the source, but similar messages have in the past been due to malicious adverts in web pages.

The links that James mentions above are good sources of support for this issue.