First see how many devices are signed in with your Apple ID account Check your Apple Account device list to find where you’re signed in - Apple Support
You can remove other devices that you don't recognise , or may be if your any family member device is also signed in the account , also your Apple ID , its password and all account credentials are known to them that's the reason they can access the account .
There are two methods to secure your iCloud account .
First update your iPhone Update your iPhone or iPad - Apple Support
Take a back up of your precious data How to back up your iPhone, iPad, and iPod touch - Apple Support
Then restore the iPhone to factory settings Restore your iPhone, iPad or iPod to factory settings using a computer - Apple Support
Once again set up new iPhone Set up your iPhone or iPad - Apple Support
And then sign inSign in to your Apple Account - Apple Support with newly created Apple ID and password How to create a new Apple Account - Apple Support to set up iCloud Set up iCloud on all your devices - Apple Support
Turn on iCloud features Change which apps sync and store data with iCloud - Apple Support
if all iCloud features are always turned as on and after that you erase the iPhone , the data is always saved on the iCloud server it will sync when phone is set up .
But the wiser way is take back up of the data as it should not be lost .
The other way is after removing the suspicious devices , change all passwords for Apple ID , the iCloud account credentials , and prefer to use 2FA , you can create a passcode to lock the iPhone .
Read Keep your Apple Account secure on iPhone - Apple Support
Regarding wifi compromising it's impossible , the network is always encrypted , you must create tough to understand password for wifi router / air port express if used , rather change the password for it Change your Wi-Fi network’s name, password and security setting in AirPort Utility on Mac - Apple Support