@jschwar313 check the IP and MAC address on the Proton to see if this is the one connected.  Also if you have an iPhone, it can read as Network Device due to the anonymous setting in the Phone Network settings.

  @DVair How do I check that.  It's incredible.  I change the admin password, the SSID and the password, and he's connected immediately.  I have no clue what's going on.  Is there a vulnerability in my router or the firmware.  This is frustrating.  I'll shut down my computer tonight and take a look at it tomorrow.  I assume he can get into my pc right?  Does proton prevent access from my router?

  @jschwar313 

Proton vpn does not help you in that case. Any unknown device can be a security risk. 

Go to advance settings, security, access control and black list that device. 
 

Also you  can turn off the router when you are not using it as that shuts them out.  Then thay have to find an other way to get online. 
 

  @jschwar313 what other devices are you changing the login info on after you change the routers info?  I am betting the unknown is a phone, due to the icon and that my iPhones behave the same way, show as Network Device.

  @DVair 

If you have an iPhone, IPad or such, in the WIFI settings (press the info icon by your network SSID), there is a setting called Private WI-FI Address which you can turn off. Then your phone will sign on with the same MAC address all the time for that network. I have it off for my home networks but on when connecting to outside networks which where it matters.

  @ArcherC8 Well, I may have blocked it now.  I saw that on my TP Link router they kept changing mac addresses, so I reached out to ATT support.  They told me how to check their app and, sure enough, there was an unknown device connected to my ATT router with a different mac address than what was on my router.  I blocked it.  Here is what it's description is in the att router/gateway or whatever it's called.  I blocked it yesterday.  I assume it's the same device as what I was trying to block in my router.  How do we know?

Also, it's not my iphone or any other device.  I have the ATT device set up in bridge mode and it's wifi turned off.  I use the tp link router for all of my internet access, since it has WPA3 and the att device has WPA2/WPA3.  I think WPA3 is more secure, from what I understand.

  @ArcherC8 yep, I knew about that setting.  I just changed the names from unkown to the devices name in the Tether App.  Left the private address settings enabled.